fix(azure): bind protected terminal run identity

[ruby-dlee]

Summary

• Query terminal protected status by the exact run established during same-attempt owner decisions.
• Refuse peer-only status output instead of rebinding result authority.
• Exercise the shipped guest region with exact-plus-peer and peer-only terminal output.

Validation

• tests/run.sh tests/fm-azure-validation.test.sh
• bin/fm-lint.sh
• shellcheck -x bin/fm-azure-validation-guest.sh tests/fm-azure-validation.test.sh
• bash syntax, Python compile, and git diff checks