fix: provision chromium scope wrapper

[rysweet]

Fix: Harden bastion tunnel port isolation and chromium provisioning

Root Cause

Process-local port allocator starting at 50200 could silently route readiness checks into an older VM through a stale bastion tunnel, causing provisioning verification to report success against the wrong VM.

Changes

• bastion_tunnel.rs: Replace fixed port allocator with OS-allocated ephemeral ports; purge duplicate-port registry claimants; verify listener ownership belongs to spawned az bastion tunnel process tree
• cloud_init.rs: Extract cloud-init provisioning logic into azlin-azure crate (+175 lines)
• vm.rs: Refactor VM operations to use new cloud-init module (-193 lines)
• auth_forward.rs: Session scope hardening for credential forwarding
• cmd_vm_ops.rs: VM ops updates for new provisioning flow
• credential-forwarding.md: Documentation update
• pr-957-chromium-provisioning.yaml: New gadugi scenario test

Validation Evidence

Run	Session ID	Timestamp	Result
run11	4076e10f	2026-04-07T23:09:24Z	✅ PASSED
run12	efa3ed15	2026-04-07T23:26:52Z	✅ PASSED

Both runs validated against fresh VM pr957-chromium-1775604412:

• ✅ Sentinel file present (/var/lib/azlin/.provisioned)
• ✅ Browser headless wrapper installed
• ✅ Alias headless wrapper installed
• ✅ GUI launch gate functional
• ✅ 16/16 focused bastion tunnel unit tests passing
• ✅ cargo check -p azlin clean
• ✅ Diff scoped to exactly 7 intended files (no formatting noise)

Closes #957