Harden deployment-path actionability

[TacoRocket]

What changed

• added explicit deployment-path actionability and insertion-point surfacing
• hardened automation actionability proof with exact RBAC-based current-operator control checks
• promoted proven edit-capable automation rows to the top priority band while keeping support-only rows low
• deduplicated deployment evidence command assembly and cleaned up repeated missing-footprint wording
• refreshed fixtures and tests to validate behavior without overfitting to wrapped table text

Why

The deployment-path slice needed to meet the newer operator-complete bar: stronger evidence-first control proof, clearer default wording, better automation start-or-edit grounding, and more resilient regression coverage.

Impact

• deployment-path rows now separate actionability, insertion point, likely Azure impact, and what is still missing more cleanly
• automation-backed rows use structured RBAC evidence instead of brittle role-name and scope heuristics
• regression coverage now checks stable behavioral signals rather than presentation artifacts

Validation

• python3 -m ruff check src/azurefox/chains/runner.py tests/test_cli_smoke.py tests/test_deployment_path_admissibility.py
• python3 -m pytest -q tests/test_deployment_path_admissibility.py tests/test_cli_smoke.py tests/test_terminal_ux.py tests/test_chain_scaffold.py tests/test_help.py
• remote pre-push guardrail: 310 passed, 2 deselected