feat: deploy hosted read-only Cockpit

[Paulo Lacerda (placerda)]

Summary

• add preview-first deployment of an authenticated, read-only AgentOps Cockpit to Azure App Service
• default Observe to the workspace Foundry project while supporting explicit multi-project, Foundry, resource-group, and subscription scopes
• separate aggregate UAMI access from per-user OBO access to protected AppGenAIContent
• add bounded discovery/query attribution, health verification, drift reconciliation, recovery journaling, documentation, and tests

Security

• grant the runtime UAMI only Reader and Log Analytics Reader on previewed scopes
• never fall back from delegated OBO to shared identity for protected content
• exclude raw protected content from URLs, caches, storage, telemetry, diagnostics, and deployment artifacts
• block unknown, destructive, or out-of-scope preview mutations

Validation

• python -m pytest tests\ -x -q — 1886 passed, 1 skipped
• feature-scoped Ruff — passed
• feature-scoped mypy — passed
• hosted Cockpit Bicep compilation — passed
• git diff --check — passed

Closes #433