feat: map observability requirements for azure

[intel352]

Summary

• adds the typed IaCProviderRequirementMapper service for Azure observability requirements
• derives a generic infra.container_service OTel Collector module for Azure Container Apps intent, covering OTel, Datadog, Prometheus, Loki, and Grafana backends
• carries derived collector command, env, secret env, and private/public ports through the ACI resource driver
• embeds plugin.json, bumps Workflow minimum to 0.64.3, adds release download entries, and moves GoReleaser publishing to .release/plugin.json
• adds strict contract validation to CI

TDD / Regression Proof

With mapper registration and ACI command wiring reverted:

$ GOWORK=off go test ./internal ./internal/driver -run 'TestAzureRequirementMapper|TestPluginManifestAdvertisesRequirementMapper|TestACIDriver_Create_CollectorConfig' -count=1
FAIL: unknown service workflow.plugin.external.iac.IaCProviderRequirementMapper
FAIL: command = [], want collector command

With the implementation restored:

$ GOWORK=off go test ./internal ./internal/driver -run 'TestAzureRequirementMapper|TestPluginManifestAdvertisesRequirementMapper|TestACIDriver_Create_CollectorConfig' -count=1
ok github.com/GoCodeAlone/workflow-plugin-azure/internal
ok github.com/GoCodeAlone/workflow-plugin-azure/internal/driver

Port bounds regression proof:

$ GOWORK=off go test ./internal/driver -run TestACIDriver_Create_CollectorConfig -count=1
FAIL: container ports = [4317 4318 9464 70000], want [4317 4318 9464]

After restoring the bound:

$ GOWORK=off go test ./internal/driver -run TestACIDriver_Create_CollectorConfig -count=1
ok github.com/GoCodeAlone/workflow-plugin-azure/internal/driver

Verification

$ GOWORK=off go test ./... -count=1
ok github.com/GoCodeAlone/workflow-plugin-azure/...

$ GOWORK=off go test -race ./... -count=1
ok github.com/GoCodeAlone/workflow-plugin-azure/...

$ GOWORK=off go vet ./...
# exit 0

$ git diff --check
# exit 0

$ GOWORK=off go run github.com/GoCodeAlone/workflow/cmd/wfctl@v0.64.3 plugin validate --file plugin.json --strict-contracts
OK workflow-plugin-azure v0.0.0 (plugin.json)

$ GOWORK=off go build -ldflags='-X github.com/GoCodeAlone/workflow-plugin-azure/internal.Version=0.1.0' -o /tmp/workflow-plugin-azure ./cmd/workflow-plugin-azure
# exit 0

$ GOWORK=off go run github.com/GoCodeAlone/workflow/cmd/wfctl@v0.64.3 plugin verify-capabilities --binary /tmp/workflow-plugin-azure .
OK workflow-plugin-azure 0.1.0 (plugin.json: 0.0.0)