feat: align lab to AzureFox 1.1.0 phase 3.5

[TacoRocket]

Summary

• align the lab release boundary and docs to AzureFox 1.1.0 / Phase 3.5
• expand the validation manifest and validator for the shipped Phase 3.5 depth and promote snapshots-disks as the first deterministic Phase 4 validator surface
• separate full from all-checks, add rerun guidance for slow commands, and require Azure-side verification after destroy

Validation

• tofu fmt -check
• python3 -c "from pathlib import Path; compile(Path('scripts/validate_azurefox_lab.py').read_text(encoding='utf-8'), 'scripts/validate_azurefox_lab.py', 'exec')"
• python3 scripts/validate_azurefox_lab.py --help
• live python3 scripts/validate_azurefox_lab.py --mode full --skip-command role-trusts ... passed during the Phase 3.5 run

Follow-ups

• AzureFox main repo still needs the PostgreSQL flexible-server collector fix for broader relational parity
• auth_policies.security_defaults remains a partial Graph-read boundary rather than a new sister-repo bug
• the current lab teardown needs a retry; Azure API verification still shows tagged network resources remaining after the interrupted destroy