Evaluate WEBSITE_RUN_FROM_PACKAGE=1 as default for App Service zip deployments

## Summary

Azure App Service supports `WEBSITE_RUN_FROM_PACKAGE=1` which mounts the deployment zip directly instead of extracting it. This provides faster cold starts and more predictable deployments, but makes the app's local filesystem read-only.

## Background

When `WEBSITE_RUN_FROM_PACKAGE=1` is set as an app setting, App Service:
- Mounts the zip package directly as a read-only filesystem
- Eliminates zip extraction time during deployment
- Provides faster cold start times
- Ensures deployment artifacts are immutable

See: [Run from package documentation](https://learn.microsoft.com/en-us/azure/app-service/deploy-run-package)

## Proposal

Evaluate whether `azd deploy` should set `WEBSITE_RUN_FROM_PACKAGE=1` by default for App Service targets using zip deploy. Key considerations:

### Benefits
- Faster cold starts (no extraction step)
- Immutable deployments (zip mounted directly)
- Reduced deployment time

### Risks
- Apps that write to their deployment directory (e.g., local SQLite, temp files, generated content) will break because the filesystem becomes read-only
- The setting persists on Azure even if azd behavior changes - users must manually remove it
- Changing deployment methods while this is set can cause app startup failures

### Questions to Resolve
1. Should this be always-on for all App Service zip deployments?
2. Should it be opt-in via `azure.yaml` service configuration (e.g., `runFromPackage: true`)?
3. Should azd detect filesystem-writing patterns and warn users?
4. How should azd handle cleanup if the user later disables this?

## Implementation Notes

The implementation would add a call to `UpdateAppServiceAppSetting` during the deploy flow in `service_target_appservice.go` to set `WEBSITE_RUN_FROM_PACKAGE=1` on the target App Service before zip deployment.