[Epic] Route requests with identity, scope, and context preserved

## Problem statement

Users should not need to understand skill topology or repeatedly provide tenant, subscription, resource, workspace, and conversation context. Routing or context loss can produce incorrect and unsafe operations.

## Outcome

Requests reach the right capability with the minimum necessary identity, scope, workspace, and conversation context preserved.

## Goals

- Improve intent disambiguation and skill selection
- Define tenant, subscription, identity, and resource resolution contracts
- Preserve relevant context across skill and tool handoffs
- Minimize unnecessary context and sensitive-data exposure

## Non-goals

- Passing all available context to every capability
- Silently choosing an ambiguous Azure scope

## Success criteria

- [ ] Routing evaluations cover positive, negative, and ambiguous requests
- [ ] Multi-tenant and multi-subscription workflows resolve scope safely
- [ ] Context handoffs are documented and validated

## Dependencies

Host orchestration, Azure authentication, resource lookup, skill routing, and evaluation infrastructure.

Start with the host orchestration, Azure authentication, resource lookup, skill routing, and evaluation infrastructure named in the dependencies. Define how routing evaluations cover positive, negative, and ambiguous requests, how multi-tenant and multi-subscription scope is resolved safely, and how context handoffs are documented and validated.

Written by the indexing model from the issue text.