Harden the Zava SRE Agent deployment and correlation demo

[Dalibor Kovacevic (RobiladK)]

Summary

• make the Zava AKS/PostgreSQL sample deploy cleanly in isolated azd environments
• align SRE Agent networking, connectors, response plans, and post-provision verification with current service contracts
• add cross-alert correlation guidance and a compound scenario that distinguishes independent co-firing faults
• make repeated demos reliable by resetting resolved stateful alert instances before fault injection
• add CI validation for generated ARM, PowerShell parsing, deployment contracts, and documentation

Key fixes

• require a /27 delegated SRE Agent subnet and update the related Terraform example
• use the current response-plan schema (meta_agent, no retired deep-investigation property, merge disabled)
• rename the Learn MCP ARM connector to the azd-safe learn-docs name and retain no-auth setup
• derive rg-$AZURE_ENV_NAME for fresh environment isolation
• harden ARM child-resource verification against eventual consistency
• preserve purpose-built response-plan routes with a bounded, mutually exclusive fallback
• teach the agent to query fired-alert history, test causal mechanisms, and avoid duplicate remediation across acknowledged threads

Validation

• completed a fresh end-to-end azd up
• exercised the compound slow-query + bad-deploy scenario twice
• verified the agent separated the missing-index latency fault from FAULT_INJECT=500 and remediated both
• ran scripts/validate-ci.ps1
• verified scripts/setup-sre-agent.ps1 against the live agent
• ran git diff --check