phase4 live pass catch-up

[TacoRocket]

What changed

This slice catches the lab up to the current AzureFox standalone validation surface and adds a lab-side SOC artifact flow for Azure Activity Log bundles.

It also moves historical checkpoint notes out of the repo and into the external AzureFox-reference notes folder so the repo keeps operational docs instead of project-history notes.

Why it changed

The lab was still carrying stale assumptions around the removed all-checks path and did not yet preserve command-level timing markers for SOC correlation against Azure Activity Log windows.

The docs folder also mixed release/operator guidance with historical checkpoint notes that fit better in the external reference workspace.

Impact

Operators now get:

• a validator aligned to the current standalone command boundary
• command-timeline.json artifacts from validator runs
• a local Activity Log bundle exporter that can include those command markers in timeline.md
• cleaner in-repo docs focused on live run, release, and SOC workflows

Validation

• tofu fmt -check
• python3 -c "from pathlib import Path; compile(Path('scripts/validate_azurefox_lab.py').read_text(encoding='utf-8'), 'scripts/validate_azurefox_lab.py', 'exec'); compile(Path('scripts/export_activity_log_bundle.py').read_text(encoding='utf-8'), 'scripts/export_activity_log_bundle.py', 'exec')"
• python3 scripts/validate_azurefox_lab.py --help
• python3 scripts/export_activity_log_bundle.py --help