azure.yaml: hydrate local.settings.json in postdeploy

[paulyuk]

What

Chains hydrate-local-settings.{sh,ps1} before configure-trigger.{sh,ps1} in the postdeploy hook, so every azd up / azd provision keeps both the deployed Function App's app settings and the local local.settings.json in sync from the same source of truth (azd env).

postdeploy:
  posix:
    run: ./infra/scripts/hydrate-local-settings.sh && ./infra/scripts/configure-trigger.sh
  windows:
    run: ./infra/scripts/hydrate-local-settings.ps1; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }; ./infra/scripts/configure-trigger.ps1

Why (the split-brain bug)

Today the env-var flow has three writers and only one auto-syncs:

            azd env (canonical)
              /              \
   azd provision        hydrate-local-settings (manual)
       │                          │
       ▼                          ▼
   Function App             local.settings.json
   ✅ auto on azd up        ❌ user has to run by hand

Reproducible failure mode:

1. azd up cold (placeholders in azd env)
2. azd env set MAILBOX_OWNER_EMAIL me@tenant.com
3. azd provision (or azd up) — deployed Function App now LIVE
4. uv run python chat.py — doctor reports 🟡 Partial: MAILBOX_OWNER_EMAIL is a placeholder

Because step 3 silently leaves local.settings.json stale, and the chat client reads from there.

With this change, step 3's postdeploy rehydrates local.settings.json from the new azd env values, and the chat client correctly shows 🟢 LIVE on next launch.

Risk

• Both scripts are already idempotent and required-on-first-use; chaining them adds no new state.
• If hydrate-local-settings fails, the && (or if ($LASTEXITCODE...)) stops the chain — same behavior as the current single-script hook.
• No README change needed: docs already tell users to run hydrate after env changes; this just makes azd up do it for them.

Stacking

Based on #15 (Go live step). Merge order: #13 → #15 → this.

[paulyuk]

Consolidated into a single PR per author preference: https://github.com/Azure-Samples/m365-inbox-serverless-agent-python/pull/(see latest)