Add live viewpoint validation proof lanes

[TacoRocket]

Summary

• add live viewpoint-aware validation support for admin, dev, and lower-privilege lanes
• align the lab AKS manifest and Terraform intent with the live OIDC posture
• update validator assertions/tests for live viewpoint artifacts and reduced-lane permission truth

Test Plan

• python3 -m py_compile scripts/validate_azurefox_lab.py
• python3 -m unittest discover -s tests -p 'test_validate_azurefox_lab.py'
• tofu validate
• tofu apply -refresh-only
• tofu plan
• tofu apply -auto-approve
• python3 scripts/validate_azurefox_lab.py --mode full --skip-command role-trusts --azurefox-dir '/Users/cfarley/Documents/HarrierOps/Azure/Family AF/AzureFox' --python /tmp/azurefox-live-venv/bin/python
• python3 scripts/validate_azurefox_lab.py --mode commands-only --viewpoint dev --azurefox-dir '/Users/cfarley/Documents/HarrierOps/Azure/Family AF/AzureFox' --python /tmp/azurefox-live-venv/bin/python
• python3 scripts/validate_azurefox_lab.py --mode commands-only --viewpoint lower-privilege --azurefox-dir '/Users/cfarley/Documents/HarrierOps/Azure/Family AF/AzureFox' --python /tmp/azurefox-live-venv/bin/python
• direct live reduced-viewpoint role-trusts captures for dev and lower-privilege
• local live demo capture refresh under proof-artifacts/latest/demo-media