bug(scanner): validate AZ-SC-001 through AZ-SC-004 against real ACR SDK models

What is wrong

The Azure client returns real azure.mgmt.containerregistry.models.Registry objects, whose relevant fields are top-level. AZ-SC-001 through AZ-SC-004 instead read registry.properties; tests reproduce that incorrect nested shape.

Real registries can therefore be silently skipped. AZ-SC-004 also applies retention expectations to Basic/Standard registries even though the retention feature is Premium-only.

Evidence: scanner/azure_client.py:932-955, scanner/rules/az_sc_001.py:38-46, az_sc_002.py:39-47, az_sc_003.py:39-47, az_sc_004.py:42-65, and tests/test_rules_supply_chain.py:27-37.

SDK source: https://learn.microsoft.com/python/api/azure-mgmt-containerregistry/azure.mgmt.containerregistry.models.registry
Retention source: https://learn.microsoft.com/azure/container-registry/container-registry-retention-policy

Acceptance criteria

• All four rules consume the real pinned SDK model shape.
• SKU/applicability behavior is correct and explicit.
• Missing properties and permission/API errors become UNKNOWN under #263.
• Contract tests instantiate/deserialize real SDK models rather than only SimpleNamespace.
• Tests cover compliant, noncompliant, empty, missing-property, 403, 429 and pagination/partial cases.
• Playbooks and framework mappings are reviewed against the repaired rule semantics.