feat(rvm): implement Azure Policy condition evaluation (#661)

Add VM support for Azure Policy's condition operators and allOf/anyOf
short-circuit logic, gated behind cfg(feature = "azure_policy").

Policy conditions (equals, contains, like, match, exists, and their
negations — 21 total) are encoded as a single PolicyCondition
instruction with a PolicyOp sub-opcode rather than bloating the
Instruction enum with 21 variants. The dispatch handles Azure Policy's
quirky comparison semantics: case-insensitive string comparison,
string↔number coercion, null vs undefined distinction, and element-wise
collection membership.

allOf/anyOf blocks use four instructions — LogicalBlockStart,
AllOfNext/AnyOfNext, and LogicalBlockEnd — that wire up a result
register and short-circuit on the first failing (allOf) or passing
(anyOf) child.

Helper functions for case-folded comparison, wildcard/glob matching, and
type coercion live in builtins::azure_policy::helpers.

Two YAML test suites (~2200 lines) exercise the full operator matrix and
the allOf/anyOf control flow.

src/rvm/tests/vm.rs

@@ -1059,4 +1059,10 @@ mod tests {
     fn run_loop_test_file(file: &str) {
         run_vm_test_suite(file).unwrap()
     }
+
+    #[cfg(feature = "azure_policy")]
+    #[test_resources("tests/rvm/vm/suites/azure_policy/*.yaml")]
+    fn run_azure_policy_test_file(file: &str) {
+        run_vm_test_suite(file).unwrap()
+    }
 }