bug(scanner): validate AZ-SC-001 through AZ-SC-004 against real ACR SDK models

[m-khan-97]

What is wrong

The Azure client returns real azure.mgmt.containerregistry.models.Registry objects, whose relevant fields are top-level. AZ-SC-001 through AZ-SC-004 instead read registry.properties; tests reproduce that incorrect nested shape.

Real registries can therefore be silently skipped. AZ-SC-004 also applies retention expectations to Basic/Standard registries even though the retention feature is Premium-only.

Evidence: scanner/azure_client.py:932-955, scanner/rules/az_sc_001.py:38-46, az_sc_002.py:39-47, az_sc_003.py:39-47, az_sc_004.py:42-65, and tests/test_rules_supply_chain.py:27-37.

SDK source: https://learn.microsoft.com/python/api/azure-mgmt-containerregistry/azure.mgmt.containerregistry.models.registry
Retention source: https://learn.microsoft.com/azure/container-registry/container-registry-retention-policy

Acceptance criteria

• All four rules consume the real pinned SDK model shape.
• SKU/applicability behavior is correct and explicit.
• Missing properties and permission/API errors become UNKNOWN under feat: persist PASS/FAIL/ERROR/NOT_APPLICABLE per rule per resource, fix compliance score #263.
• Contract tests instantiate/deserialize real SDK models rather than only SimpleNamespace.
• Tests cover compliant, noncompliant, empty, missing-property, 403, 429 and pagination/partial cases.
• Playbooks and framework mappings are reviewed against the repaired rule semantics.

[m-khan-97]

@ritiksah141, once the #293 namespace-exclusion correction is pushed, please post your initial approach for #301 before implementation. In particular, confirm how you will test real azure.mgmt.containerregistry.models.Registry instances, Premium-only retention applicability, and 403/429/partial collection without converting unavailable evidence into a clean result. That will let us catch contract issues before the four ACR rules are rewritten.

[ritiksah141]

@m-khan-97, will do that once the #293 lands and will share the plan before the execution.