Replace azure-deploy skill AcrPull RBAC propagation health check with a script

## Summary

Copilot has identified a portion of a skill that is a good candidate for replacement with a script.

The candidate is the **AcrPull RBAC propagation health check** in the `azure-deploy` skill — a fixed sequence that resolves a Container App's managed-identity principal, resolves the ACR scope, then polls `az role assignment list` until the `AcrPull` role has propagated.

## Candidate description

Before a Container Apps deployment can pull its image, the skill verifies (and waits for) the `AcrPull` role assignment to propagate. This is a deterministic three-step poll:

1. `az containerapp identity show ... --query principalId -o tsv` — get the managed identity's principal ID.
2. `az acr show ... --query id -o tsv` — get the ACR resource ID (the role scope).
3. Poll `az role assignment list --scope --assignee-object-id --query "[?roleDefinitionName=='AcrPull']"` up to 5× with 60s backoff, emitting a clear pass/fail result; on failure, optionally create the assignment and retry.

This is a strong script candidate because it is:
- **Already shipped as parallel bash _and_ PowerShell** in two places, proving the logic is mechanical.
- **A fixed poll-with-backoff loop** — exactly the boilerplate (retry counter, sleep, JMESPath filter) that is error-prone to re-derive on every run and trivially reused once written.
- **Output-reducing** — `az role assignment list` returns a large array; the script collapses it to a single present/absent boolean plus a human-readable status line.
- **Duplicated and cross-referenced** — the same verify-wait-retry flow appears in `pre-deploy-checklist.md` and `recipes/azd/errors.md`, and is referenced from `SKILL.md`, `troubleshooting.md`, and `live-role-verification.md`.

**Sketch — `wait-acrpull-rbac.{sh,ps1}`:**
- **Input:** `--app-name`, `--acr-name`, `--resource-group`, optional `--max-attempts`/`--interval`, optional `--create-if-missing`.
- **Output:** a single status line — `AcrPull confirmed for on ` or `AcrPull not found after N attempts` — plus a non-zero exit on timeout.

> Choosing the deployment path (Bicep/AZD vs. Terraform two-phase), the decision to create the role assignment vs. wait, and the manual-assignment fallback stay in prose. The script only resolves the identity/scope and runs the poll.

## Affected file and lines

- [`references/pre-deploy-checklist.md` — Container Apps + ACR pre-deploy RBAC health check (L336–L419)](https://github.com/microsoft/GitHub-Copilot-for-Azure/blob/3890cbfb65c548ce8daa96cabd1d8de63f7bbcca/plugin/skills/azure-deploy/references/pre-deploy-checklist.md#L336-L419)
- [`references/recipes/azd/errors.md` — Container App Revision Timeout RBAC check + remediation (L39–L117)](https://github.com/microsoft/GitHub-Copilot-for-Azure/blob/3890cbfb65c548ce8daa96cabd1d8de63f7bbcca/plugin/skills/azure-deploy/references/recipes/azd/errors.md#L39-L117)

## Next steps

1. **Evaluate the candidate** — confirm the steps are stable and parameterizable, and that the script captures everything the skill needs.
2. **Create both a bash _and_ a PowerShell version** of the script so the skill works across platforms.
3. **Run integration tests** to verify the scripts behave correctly and the skill still completes end-to-end.

## Background Information

### Why replace regular steps with scripts

Replacing a regular, well-defined series of steps with a script can:

- **Reduce token usage** — the skill no longer needs to spell out each command and parse large command output inline; the agent invokes one script and reads a compact result.
- **Improve reliability** — the logic is written and tested once, instead of being re-derived by the agent on every run.
- **Improve determinism** — the same inputs always produce the same steps and output, removing run-to-run variation.
- **Improve speed of execution** — a single script call replaces multiple round-trips of command generation, execution, and large-output parsing.

### Authoring notes for the scripts

- **Reference scripts with markdown links**, not just a bare path to the script file.
- **Include examples** in the skill showing how to run each script (sample invocation with arguments).
- **Briefly explain what each script does** where it is referenced.
- **The script output should explain what it did**, so the agent and user can understand the result without re-inspecting raw command output.