ci(deploy): Azure log step should run on failure; stop swallowing terraform output errors; add tests for health-check scripts #438

Follow-ups from the review of #437 (closes #217):

• deploy-azure.yml ~481: the Container App log step has no if: always(), so logs are missing exactly when the health check fails. Add if: always() (and have it tolerate a missing deploy gracefully).
• deploy-azure.yml ~288: terraform output ... 2>/dev/null || echo "" swallows errors; drop the fallback so a missing output fails loudly at the source.
• fix(ci): fail Azure deployment verification on degraded health and log lookup errors #217 asked for committed tests of the verification logic. Extract the health/smoke check into a script under scripts/ and add a test (bats or Go) feeding healthy / degraded / non-JSON / empty / 503 responses.
• Nit: the warm-up curl uses --max-time 60, above the server's 30s WriteTimeout.