Fixes the Azure per-operation identity footgun for custom runner templates, once and for all.

Today: if an azure-bicep app defines per-operation identities (any azure permission role) AND pins a custom runner_nested_template_url, ctl-api creates the user-assigned identities but never attaches them to the runner VMSS — only the built-in runner attaches them. The runner then can't get an IMDS token for the per-op identity and provisioning fails with an opaque "Identity not found".

• getRunnerLinkedDeployment: when a custom runner template declares a userAssignedIdentities object parameter, inject the per-op identity attachment map + the dependsOn on the identity resources. Backward compatible — templates without the param are unaffected.
• hard error at render if per-op identities exist but the custom template can't accept them (points to the fix or the built-in runner).
• sync-time validation (ValidateAzureRunnerIdentities): the same check at nuon apps validate, so vendors catch it before any install exists instead of at sandbox runtime.

Pairs with install-stacks: the shared azure/runner.json now declares the param.