fix(azure): preserve exact worker image on replay

[ruby-dlee]

Summary:

• allow the owner-private no-mistakes worker config to carry the exact immutable Azure Compute Gallery image-version ID and a single canonical IPv4 operator data-plane route
• forward both values to lifecycle without shell interpretation so replay cannot fall back to a marketplace image or close the storage route
• preserve fail-closed validation: CIDRs, IPv6, whitespace, noncanonical IPv4, and broad 0.0.0.0/0 access are rejected
• keep CI fixtures aligned with shared reviewer-host admission and bounded timeout exit semantics

Verification:

• focused credential-expiry, watcher-triage, behavior-shard, and no-mistakes-worker regressions
• shellcheck --norc -x on all touched shell tests
• bin/fm-behavior-shards.sh --check 8
• git diff --check
• cold adversarial review: CLEAR