Prepare Azure US release qualification while retaining hosted Azure EU routing

[morgaesis]

Azure EU timeouts prevent new CLI releases from completing qualification. This change prepares a separate Azure US calibration and release route while the embedded hosted review profile remains on Azure EU.

Calibration and release requests pin azure/us, require data_collection: deny and zdr: true, and disable provider fallback. New releases stop before benchmark model calls until the committed US baseline and attestation verify a complete ten-sample calibration from the first attempt on main. The existing EU baseline and attestation remain unchanged.

Validation: offline Rust, benchmark, installer, and mocked cohort tests passed. The exact local review found zero findings with complete coverage and cost accounting.

[postil-dev]

1 blocking finding open
1 finding posted inline

_{Review details}

[postil-dev]

2 blocking findings open
1 finding posted inline

Before the next push

Run postil review --staged.

_{Review details}

[postil-dev]

review incomplete · 2 blocking findings open

_{Review details}

[morgaesis]

@postil review the current head

[postil-dev]

2 blocking findings open · 1 advisory finding open
2 findings posted inline

1 suppressed

Screening workflows use a profile different from the embedded provider

bench/README.md:105

Suppressed: below the configured confidence threshold.

Severity error, confidence 0.12.

The release and calibration workflows now use the Azure/US screening profile while the embedded hosted profile remains Azure/EU. This makes qualification evidence validate a different provider contract than the released binary. Import authenticated US calibration evidence and embed the matching US configuration, or keep the workflows on the EU profile.

_{Review details}