[CI/CD] Chat Container App deploy fails: OIDC principal cannot write ACR role assignments

## Summary

`deploy-dev-chat` in the promoted CD workflow fails when assigning an ACR role to the Chat Container App managed identity. The GitHub OIDC service principal lacks `Microsoft.Authorization/roleAssignments/write` on the ACR.

## Verified evidence

Run: https://github.com/azurenoops/spin_agent/actions/runs/33804223965 (2026-09-03, `workflow_dispatch`)

Failed job: `deploy-dev-chat / deploy`

Log excerpt:

```
WARNING: Failed to query 949249b0-db00-4f5b-9ba5-ddd00c48a7b9 by invoking Graph API.
ERROR: Role assignment failed with error message: "(AuthorizationFailed)
The client '…' with object id 'cda4f218-256b-4670-8609-4631bdba5ab6'
does not have authorization to perform action
'Microsoft.Authorization/roleAssignments/write' over scope
'…/registries/atocopilotacr/providers/Microsoft.Authorization/roleAssignments/…'
```

## Impact

Even when MCP and Dashboard deploy succeed, Chat deploy fails. Because CD is sequential, test and production never run.

## Suggested fix

- Pre-create the AcrPull assignment in Terraform (Epic #123) and make the workflow step idempotent / skip-if-exists
- Or grant the deploy SP a narrower custom role **only if** that is the intended model
- Do not keep retrying `az role assignment create` from CD if Graph lookup also fails

Start with the promoted CD workflow and the deploy-dev-chat / deploy job, then inspect the Terraform work referenced by Epic #123. Reproduce the failed workflow run and trace the AcrPull role-assignment step, including the Graph lookup failure. Done means Chat deploy succeeds without unauthorized role-assignment writes and the sequential test and production deployments can proceed.

Written by the indexing model from the issue text.