[P2] ci-cd: guardrail does not validate required APIM CORS origins

## Problem
Current post-deploy guardrail in azd-deploy validates only presence of block, not required environment origins.

## Why this matters
CI can pass while APIM CORS policy is still missing the live SWA origin, causing real browser failures after successful deploy/provision runs.

## Evidence
- azd-deploy run succeeded previously while CORS error persisted in browser.
- Live policy for configuration-api had but only localhost origins.

## Reproduction
1. Deploy infra/workflows successfully.
2. Keep APIM policy with localhost-only origins and no SWA origin.
3. Observe workflow guardrails pass but browser requests fail due CORS.

## Impact
- User impact: High (false-positive green pipeline).
- Blast radius: CI/CD reliability and release confidence.

## Acceptance Criteria
- [ ] Guardrail explicitly checks required origins list, including active SWA default hostname and configured custom domains.
- [ ] Guardrail fails with clear diff (missing origins).
- [ ] Non-prod remediation step can apply/update APIM per-service policy when origins drift.
- [ ] Add test coverage or workflow assertion for origin completeness.