fix: attach azure per-op identities to custom runner templates (#1953)

azure: attach per-op identities to custom runner templates

feat: curated custom stacks for gcp-terraform (#1944)

* gcp: render curated custom stacks

* pass through git directory sources

* resolve params from install inputs

* allow forked module repos

---------

Co-authored-by: nuonbot <[email protected]>

feat: azure per-operation runner managed identities (#1946)

* feat: azure per-operation runner managed identities

* fix: render azure policies in dashboard role view

* fix: make azure role assignment names what-if analyzable

* fix: keep azure custom/break-glass role deployment names under 64 chars

* fix: gate azure phone-home on identity role setup so partial failures don't report outputs

* fix: keep azure role assignment names stable for idempotent redeploys

* fix: use stable what-if-clean role assignment names (revert principalId-based churn)

* fix: surface azure roles in install available-roles endpoint

* chore: trim comments and dedupe azure role deployment name expr

* fix: reset gen code

* fix: keep acr pull/push on runner system identity for image sync

fix: helm plan shows base64 parse error for every secret (#1939)

fix: copy manifests before helm diff

fix: Validate unique custom_nested_stacks index; bound template fetch…

… timeout (#1937)

validate unique custom_nested_stacks index at sync; bound template fetch timeout

fix: make Cloud DNS NS delegation idempotent (#1932)

Co-authored-by: nuonbot <[email protected]>

fix: qualify Cloud DNS NS rrdata with trailing dot (#1931)

fix: normalize trailing dot in DNS delegation root domain check (#1929)

fix: qualify ACR sync repository output with login server (#1917)

Co-authored-by: nuonbot <[email protected]>

feat: support Azure managed identity pulling GAR images (#1916)

* docs: document Azure GAR access via azure_principals

* feat: federate Azure managed identity to GCP for GAR image pulls

---------

Co-authored-by: nuonbot <[email protected]>