docs: add Azure SAS policy evidence gates

[catcherintheroad-hub]

Summary

• Adds a Storage Bearer Access Evidence step for Azure storage reviews.
• Adds detailed checks for Shared Key authorization, account/service/user delegation SAS, SAS expiry, stored access policies, external principals, and ADLS Gen2 ACL parity.
• Adds edge-case fixtures for private storage accounts that still expose data through broad SAS tokens or effective data-plane access.

Created from review issue

Fixes #1329

What was wrong

The Azure review could treat storage accounts as safe when public access was disabled, HTTPS/TLS were configured, and network rules were hardened. That misses broad bearer-token paths such as long-lived account SAS, service SAS without stored access policies, Shared Key access, external RBAC principals, and ADLS Gen2 ACL divergence.

What changed

• Added Step 10A to azure-review/SKILL.md for storage bearer access evidence.
• Added an output table for Shared Key, SAS type, expiry, stored access policy, external principal, and ACL/RBAC parity status.
• Extended the detailed benchmark checklist with concrete SAS/shared-key/stored-policy/effective-principal review gates.
• Added tests/storage-sas-policy-edge-cases.md.

Validation

• git diff --check
• Added-line non-ASCII scan
• Added-line prompt-injection marker scan
• Markdown code-fence balance check
• Microsoft Learn reference URL checks returned HTTP 200