feat(skills): adopt AVM-first module sourcing for Azure IaC guidance

Nobody has claimed this yet.

### Skill Name

azure-iac-solution

### Programming Language

Other

### Purpose

HVE Core's Azure IaC guidance is language-oriented rather than solution-oriented. The `terraform` and `bicep` instruction files teach Copilot how to produce plausible HCL and Bicep, but they start by inventing local modules (`terraform/modules/`, `modules/networking.bicep`) and never ask whether a suitable Azure Verified Modules (AVM) pattern or resource module already exists. AVM is Microsoft's IaC module strategy and is only referenced incidentally today.

This request covers two changes:

1. Add a mandatory "Azure module sourcing" section to both language instructions establishing the AVM-first hierarchy: pattern module → AVM resource modules → native AzureRM/AzAPI/Bicep resources only for gaps → local modules only for genuine solution-specific reuse, with each direct-resource exception recorded.
2. Add a dedicated documentation-driven `azure-iac-solution` skill that owns AVM catalogue discovery, the module suitability test, a module decision record, the architecture-to-code workflow, and an AVM-aware review checklist.

AVM mention Spec Kit in their approach to AI-led solution development, rather than this we would adopt the underlying principles within HVE Core, leveraging IaC guidance from the AVM team.

### Prerequisites

None. The skill is documentation-driven (no scripts, no executable runtime), so no `SECURITY.md` is required. Module versions must be resolved from the registry at execution time rather than recalled from model knowledge.

### Requirements

* AVM pattern modules preferred when topology, controls, and lifecycle fit
* AVM resource modules composed for remaining capabilities
* Native resources permitted only with a recorded rationale (no AVM coverage, missing capability in the published version, essential preview API, brownfield constraints, or explicit caller requirement)
* Module versions pinned and resolved from the registry at execution time; orphaned/deprecated AVM lifecycle states inspected before adoption
* Module decision record produced before implementation, per capability
* Review checklist flags handwritten resources where AVM exists, thin wrappers, unpinned references, deprecated dependencies, and unrecorded exceptions without rejecting native resources outright
* Behavior-conformance eval stimuli backlinking the new skill and the updated `terraform` and `bicep` instructions

Start by locating the existing terraform and bicep instruction files and the current azure-iac-solution skill. Review how behavior-conformance eval stimuli link to skills, then define the AVM-first guidance, decision records, workflow, and review checklist described in the requirements. Done means both instructions are updated, the dedicated skill covers the requested workflow, and eval stimuli backlink all three artifacts.

Written by the indexing model from the issue text.