fix(azure): require foundation identity for no-mistakes workers

[ruby-dlee]

Summary

• require the complete Azure foundation identity before the no-mistakes wrapper can dispatch lifecycle work
• document every required out-of-band field in the copy-and-fill config
• fail closed before lifecycle dispatch when any newly admitted foundation field is absent

Verification

• Python compilation passed
• Shellcheck passed
• the focused no-mistakes worker suite passed
• diff check passed
• cold adversarial review returned CLEAR on exact head 8bb5a80