feat(azure_policy): test runner, compiler fixes, and example program (#700)

Adds the YAML test runner that exercises the companion test data PRs, plus
several compiler fixes surfaced during testing:

- Removed parameter register caching that produced wrong results inside
  short-circuiting allOf/anyOf blocks; added literal-index caching for
  parameter defaults to avoid repeated O(n) literal-table scans
- Simplified cross-resource effect details to only emit roleDefinitionIds
  and type (deployment templates are not evaluated for compliance)
- Replaced guid/uniqueString builtins with clear "unsupported" errors
- Normalized datetime output to ISO 8601 with Z suffix
- Added azure_policy parser MAX_COL constant (8192) for long template
  expressions, keeping the global DEFAULT_MAX_COL at 1024
- Added rvm to azure_policy feature dependencies since the compiler
  targets RVM bytecode

Also restructures the example binary into examples/regorus/ with new
azure-policy-eval and azure-policy-aliases subcommands, adds C# alias
normalization tests, and documents Azure Policy support in the README.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

README.md

@@ -129,7 +129,7 @@ It is straight-forward to build these bindings yourself.
 
 ## Getting Started
 
-[examples/regorus](https://github.com/microsoft/regorus/blob/main/examples/regorus.rs) is an example program that
+[examples/regorus](https://github.com/microsoft/regorus/blob/main/examples/regorus/main.rs) is an example program that
 shows how to integrate Regorus into your project and evaluate Rego policies.
 
 To build and install it, do
@@ -248,6 +248,52 @@ $ diff <(regorus eval -b tests/aci -d tests/aci/data.json -i tests/aci/input.jso
 ```
 
 
+## Azure Policy (Preview)
+
+Regorus can evaluate [Azure Policy](https://learn.microsoft.com/en-us/azure/governance/policy/overview)
+definitions natively. A dedicated compiler translates Azure Policy JSON
+directly into RVM (Regorus Virtual Machine) bytecode — the same VM that
+powers Rego evaluation — so you don't have to rewrite policies in Rego.
+Enable it with the `azure_policy` cargo feature.
+
+Most of the policy language is supported: conditions with `field`, `count`,
+and `value`; logical connectives (`allOf`, `anyOf`, `not`); comparison
+operators; template expressions like `parameters()`, `concat()`,
+`dateTimeAdd()`, and `utcNow()`; and effects including Deny, Audit, Modify,
+Append, AuditIfNotExists, and DeployIfNotExists. An alias registry handles
+the translation from fully-qualified alias names to the flattened ARM resource
+shape expected by the engine.
+
+### Quick start
+
+```bash
+cargo install --example regorus --features azure_policy --path .
+
+# Evaluate a policy against a non-compliant storage account (→ Deny)
+regorus azure-policy-eval \
+    --policy-definition examples/regorus/azure_policy_data/require_https_storage.json \
+    --resource examples/regorus/azure_policy_data/non_compliant_storage.json \
+    --aliases tests/azure_policy/aliases/test_aliases.json
+
+# Same policy against a compliant resource (→ undefined, no effect)
+regorus azure-policy-eval \
+    --policy-definition examples/regorus/azure_policy_data/require_https_storage.json \
+    --resource examples/regorus/azure_policy_data/compliant_storage.json \
+    --aliases tests/azure_policy/aliases/test_aliases.json
+
+# List aliases for a resource type
+regorus azure-policy-aliases \
+    --aliases tests/azure_policy/aliases/test_aliases.json \
+    --resource-type Microsoft.Storage
+```
+
+The test suite covers conditions, effects, template functions, alias
+resolution, and end-to-end scenarios across YAML-driven test files:
+
+```bash
+cargo test --features azure_policy -- azure_policy
+```
+
 ## Performance
 
 To check how fast Regorus runs on your system, first install a tool like [hyperfine](https://github.com/sharkdp/hyperfine).