Add Azure diagnostic pipeline evidence gates

[malb200710-dev]

Summary

• Adds an Azure diagnostic pipeline integrity step for scope coverage, category coverage, destinations, retention, destination hardening, and sample export validation.
• Expands the CIS Section 5 checklist with Terraform examples for subscription Activity Log diagnostics, Key Vault AuditEvent diagnostics, partial-category failure cases, and Log Analytics retention.
• Links implementation to review issue [REVIEW] azure-review: add diagnostic category and retention evidence gates #1624.

Validation

• Confirmed markdown code fences are balanced.
• Confirmed edited files remain ASCII.
• Checked the new version, diagnostic pipeline table, category guidance, retention guidance, and export validation text are present.

Bounty request: Improver Moderate ($100) if accepted. I can provide payment details if accepted.