fix(azure): fence retired execute claims

[ruby-dlee]

Summary:

• retain empty Azure task-command children until ordinary VM teardown while fencing retired execute claims with durable and cloud-bound keys
• require exact worker, resource, immutable-ID, assignment, and action-key identity before claim recovery
• preserve fail-closed custody across crashes and cloud metadata replacement

Verification:

• bash tests/fm-azure-pilot.test.sh
• bash tests/fm-worker-lifecycle.test.sh
• bash tests/fm-no-mistakes-worker.test.sh
• bash tests/fm-no-mistakes-runtime.test.sh
• bash tests/fm-nm-step-liveness.test.sh
• Python compile, shellcheck, diff check
• cold adversarial review: CLEAR