Add persistence helper review followups

[TacoRocket]

Summary

• add Container Apps Jobs and VM Extensions flat helpers plus grouped persistence surfaces
• apply review followups for command clue redaction, proof boundaries, bounded DevOps discovery, compact tables, and shared persistence helpers
• refresh golden outputs for affected persistence surfaces

Validation

• GOCACHE=/tmp/ho-azure-gocache go test ./...
• sensitivity sweep staged with live subscription/org literals; exact live literals scrubbed, remaining findings are fake fixture IDs/Contoso-style test URLs