Reframe deployment path around source actionability

[TacoRocket]

Summary

• reframe deployment-path around controllable Azure change paths instead of target-first output
• enrich devops with trusted inputs, source visibility, trigger semantics, current-caller actionability, joinable identity fields, secret-support categories, and explicit missing-state boundaries
• keep target hints as downstream consequence grounding and add bounded support-only rows plus full-width why it matters rendering

Why

• queueability alone was reading too strongly, while target hints were pulling attention away from the source-side injection and execution story
• this slice needed to answer what current credentials can see, do, and not yet prove

Validation

• python3 -m ruff check src tests scripts
• PYTHONPATH=src python3 scripts/generate_schemas.py
• PYTHONPATH=src python3 -m pytest -o cache_dir=/private/tmp/pytest-cache-dns tests/test_collectors.py tests/test_golden_outputs.py tests/test_contract_schemas.py tests/test_cli_smoke.py tests/test_help.py tests/test_terminal_ux.py tests/test_models.py
• PYTHONPATH=src python3 -m pytest -o cache_dir=/private/tmp/pytest-cache-all
• pre-push guardrail: 259 passed, 2 deselected in 1.58s