fix(azure): accept durable reservation generation during cleanup

[ruby-dlee]

Summary

• preserve strict exactness for normal provider operations
• permit cleanup to accept only a present, canonical, strictly older cloud generation on the durable global reservation
• require every reservation ownership tag and keep all other resources exact

Live failure addressed

Azure cleanup claims for slots 1-3 were correctly fenced because replacement compute had advanced to generation 3 while the durable slot reservation retained generation 1. All task, account, worktree, and immutable identities matched.

Verification

• python3 -m py_compile bin/fm-azure-worker-provider.py
• shellcheck --norc -x tests/fm-worker-lifecycle.test.sh
• git diff --check
• bash tests/fm-worker-lifecycle.test.sh
• cold adversarial review: CLEAR

No updater is involved. Deployment will pin the exact reviewed source revision.