Workbooks: make remaining implicit and innerunique ARG join kinds explicit

🛠️ Cleanup

Follow-up to PR #2225 (repo-wide KQL join/lookup review). Two style-only patterns remain across the workbooks. All are benign today because the left-side join keys happen to be unique, but they rely on that implicitly — an upstream mv-expand/union added later would silently start dropping rows.

1. 48 bare | join ( without explicit kind= (baselined in the lint)

src/powershell/Tests/Lint/KqlJoinKinds.Tests.ps1 fails on any new bare join and carries a per-file ratchet baseline for the pre-existing ones:

Nearly all are the copy-pasted ResourceContainers | ... | join (resources | ...) on subscriptionId subscription-name pattern → should be join kind=inner. Two need slightly more care: query - Firewall per Location and Get-Idle-PIP (Networking.workbook) sit after an mv-expand, where the implicit innerunique dedup is load-bearing — make the dedup explicit (distinct/summarize before the join) and then use kind=inner.

When fixing a file, lower its baseline count in KqlJoinKinds.Tests.ps1 (the test enforces this). Remove the entry when it reaches 0.

2. ~75 join kind = innerunique(... | distinct <key>) on <key> tag-filter semi-joins

The tag-filter pattern used across the optimization workbooks. Since the right side is distinct and the left key is unique, innerunique behaves identically to inner — but kind=inner states the intent and removes the reliance on left-key uniqueness. Pure find-and-replace within the queries; not tracked by the lint (kind is explicit).

ℹ️ Additional context

• The two AHB workbooks are near-verbatim copies of each other — fixes must land in both.
• Good candidate for an incremental cleanup: the ratchet means partial progress is locked in per file, no big-bang PR needed.

Start with src/powershell/Tests/Lint/KqlJoinKinds.Tests.ps1 and its per-file baselines, then inspect the listed workbook files for bare joins and innerunique tag-filter joins. Work incrementally across both AHB.workbook copies, Networking.workbook, and governance/workbook.json, taking extra care with the two mv-expand cases. Done means explicit join kinds throughout and each lint baseline reduced or removed, with the lint test passing.