P1: Add ACA bootstrap contract guardrail in CI

## Context\nDeployment blocker #86 showed repeated ACA revision Operation expired failures while affected apps retained placeholder bootstrap runtime settings.\n\n## Goal\nAdd a CI guardrail that validates ACA bootstrap/runtime contract assumptions early and fails with actionable diagnostics when drift/mismatch is detected.\n\n## Acceptance Criteria\n- [ ] Add automated guard step in workflow path (or dedicated reusable check) for backend ACA bootstrap contract\n- [ ] Guard emits clear classification in step summary (e.g., PortMismatch, PlaceholderStuck, ControlPlaneTimeout)\n- [ ] Guard output includes affected service names and expected vs observed values\n- [ ] Add runbook note in docs/runbooks/azd-deployment.md referencing guard behavior\n\n## Links\n- Parent incident: #86\n- Recovery workflow PR: #102