ARM API Reviewer agent: rule ID links point at an SSO gated repository

## Summary

The ARM API Reviewer requires every rule ID in a posted comment to be a markdown link to its authoritative source. Thirty of those citations point at `github.com/cloud-and-ai-microsoft/resource-provider-contract`, which is not publicly resolvable. Requesting it redirects to the Microsoft enterprise SSO sign in page, and the GitHub API returns 404 for it.

Because the reviewer posts on the public `Azure/azure-rest-api-specs` repository, an external contributor who clicks a rule ID link lands on a sign in wall rather than the rule.

## Evidence

A HEAD request returns HTTP 200, which is misleading. Fetching the content shows the redirect:

```
https://github.com/enterprises/microsoft/sso?return_to=...resource-provider-contract...
```

The ARM Wiki reached the same conclusion independently. Commit `fb9089eb52ee` on 2026-07-29, "Relocate Resource Provider Contract (RPC) docs under api_contracts and repoint inbound links", rewrote its own references away from that URL to relative wiki paths. The diff is link substitution only, 17 insertions and 17 deletions, with no rule content changed.

## Blast radius

Thirty citations across seventeen files:

| File | Citations |
| --- | --- |
| `.github/instructions/arm-api-review.instructions.md` | 11 |
| `.github/instructions/openapi-review.instructions.md` | 2 |
| `.github/skills/azure-api-review/references/example-quality.md` | 2 |
| `.github/skills/azure-api-review/references/tracked-resource-lifecycle.md` | 2 |
| `.github/agents/arm-api-reviewer.agent.md` | 1 |
| `.github/instructions/typespec-review.instructions.md` | 1 |
| Eleven further reference files | 1 each |

## Why this is worth deciding rather than patching

There may be no public home for the Resource Provider Contract. The ARM Wiki moved to relative wiki paths, which are also access controlled, so a direct substitution would not make the links public either. The decision needed is what a rule ID should link to when it is posted on a public repository:

1. Keep the gated link and accept that external contributors cannot open it.
2. Link to a public restatement of the rule, for example the relevant section of the repository's own instruction files.
3. Link to the gated source but include enough of the rule text in the comment that the link is not required to act on the finding.

Option 3 preserves provenance while keeping the finding self contained, and it matches how the reviewer already handles findings whose fix lives in an out of band process.

## How this was found

While verifying whether the `Upstream alignment: 2026-04-15` markers on the shared reference files were stale. That check found no rule drift. The ARM Wiki has 257 commits since the alignment date, but only one touched a cited file and it changed links rather than rules. The Azure REST API Guidelines vNext file was last modified 2025-04-02, before the alignment date, and `@microsoft.azure/openapi-validator-rulesets` is still 2.2.6 both in this repository and on npm.

## Related

Follows the hardening work in #45841.

Read .github/instructions/arm-api-review.instructions.md and the listed reviewer instruction and reference files, then review related issue #45841. Decide how public findings should cite gated rules; done means the citation policy is settled and all 30 affected links are handled consistently across the 17 files.

Written by the indexing model from the issue text.