perf(azure): skip redundant worker tag writes

[ruby-dlee]

Summary

• avoid rewriting Azure worker tags when every exact assignment tag is already present
• retain the existing repair path for missing or differing tags
• cover both no-op convergence and selective repair with an executable regression

Why

Real admission tracing showed exact resources being tagged again after the deployment had already produced the correct identity. Those writes make Azure reconverge the VM extension and managed Run Commands, adding control-plane latency without changing the worker boundary.

Verification

• python3 -m py_compile bin/fm-azure-worker-provider.py
• bash tests/fm-worker-lifecycle.test.sh
• bash tests/fm-azure-pilot.test.sh
• bin/fm-lint.sh
• git diff --check

Safety boundary

One-review/one-VM isolation, exact assignment tags, exact-head binding, credential custody, cleanup proof, and fail-closed behavior are unchanged. Any missing or differing required tag still takes the existing mutation and convergence path.