Add Azure command families and release packaging updates

[TacoRocket]

Summary

• add first-wave evasion, resourcehijacking, and pathmasking grouped command families with supporting flat helpers and goldens
• add monitoring-sinks, DCR, diagnostic-settings, App Insights, and Relay helper coverage
• tighten release packaging with multi-arch container smoke checks and stable/preview Homebrew tap dispatch paths
• close review cleanup debt around grouped-family plumbing, command/render registries, CSV rendering, reduced-visibility output, and table whitespace

Validation

• sensitivity sweep: no real live subscription literal found; deterministic fixture IDs only
• ruby YAML parse for release and Homebrew tap workflows
• scripts/release_smoke_unix.sh against a locally built binary
• git diff --cached --check
• GOCACHE=/tmp/ho-azure-gocache go test ./...