[P2] foundry: serialize model deployment updates to avoid RequestConflict

## Problem
Foundry model deployment updates can conflict with concurrent parent-account operations, causing `409 RequestConflict` and failing infrastructure provision.

## Type
- bug

## Evidence
- Workflow run: https://github.com/Azure-Samples/tutor/actions/runs/23124471384
- `Provision infrastructure` includes error for `module.ai_foundry.azapi_resource.ai_model_deployment["gpt-5"]`:
- HTTP 409 `RequestConflict`
- message: `Another operation is being performed on the parent resource .../Microsoft.CognitiveServices/accounts/...`

## Reproduction
1. Run infra provision where Cognitive Services account and model deployments are modified in same apply window.
2. Observe intermittent 409 on model deployment update when parent account operation is still in progress.

## Acceptance Criteria
- [ ] Foundry model deployment updates are serialized after parent account operations settle.
- [ ] Add bounded retry/backoff for Foundry 409 conflicts with explicit detection.
- [ ] Provision no longer fails due to parent-resource operation contention under normal deploy cadence.
- [ ] Add diagnostic summary for Foundry conflict retries.

## Suggested Owner
`system-architect` + `platform-quality`