Wire Azure AI Foundry into research-run routing (main-process)

[blisspixel]

Completes the multi-cloud provider goal — Azure AI Foundry deployments now run research stages, alongside the Bedrock routing already on main. Together they deliver "meet people where they are" for AWS and Azure.

The Foundry wrinkle, solved honestly

A Foundry model id is the user's deployment name (arbitrary), so primr can't ship a fixed priced registry entry. The operator declares the deployment and its pricing via env, and nothing is guessed into the cost gate:

AZURE_OPENAI_DEPLOYMENT=<your-deployment-name>
AZURE_FOUNDRY_PRICE_AS=gpt-5.4          # price/spec as a registered model
# ...or explicit rates instead:
# AZURE_FOUNDRY_INPUT_PRICE=2.50
# AZURE_FOUNDRY_OUTPUT_PRICE=15.00
AI_REASONING_MODEL=<your-deployment-name>   # select it for a stage

PrimrModels._resolve_config centralizes model lookup so get_model_config, get_price, and the cost-breakdown paths all resolve the declared deployment. If pricing isn't declared, the lookup returns None → the cost gate fails closed (unknown model) rather than mispricing a run.

Security boundary (same as Bedrock)

Main-process only. Foundry routing is refused inside a supervised MCP worker (Azure creds are never inherited); the guard and allowlist regression pin already cover foundry from the Bedrock change.

Verified — $0

• tests/test_ai/test_foundry_routing.py (6): price-as + explicit pricing resolve; fail-closed without pricing; only the declared deployment name resolves; routing returns AzureFoundryProvider in-process; refused in a worker.
• Affected suites (config, cost estimator, routing, llm dispatch, stage routing, provider foundation, cost properties, architecture): 378 passed; ruff + mypy clean; doc-link test green.
• Docs updated: .env.example, the Foundry deploy README (corrected the "not yet wired" note), CHANGELOG.

After this merges, I'll cut 1.38.0 with both Bedrock + Foundry.