[dguido]

Azure deployments failed before provisioning because the optional dependencies omitted SDKs imported by the Azure collection and selected incompatible resource, compute, and network SDK versions. Linode deployments failed on the missing ansible_specdoc import.

Pin azure.azcollection 4.2.0 and the SDK versions imported by its shared module, including azure-cli-core 2.91.0. This release removes the old CLI cryptography cap, so Algo keeps cryptography 50.0.2. Pin Linode's collection and include its specdoc and polling dependencies. Deployment and teardown install extras from the audited lock and skip providers without Python extras.

Azure now resolves subscriptions from explicit settings, the environment, or the active CLI account. It loads current physical regions, excludes staging and preview locations, and validates menu input before deployment. Azure teardown reads credentials without requesting regions. The privacy role skips rsyslog configuration and restart when rsyslog is absent while retaining journald and cleanup settings.

CI installs the pinned collections and Azure, Linode, and Hetzner extras. New tests exercise real collection imports, the Azure locations response, subscription precedence and failures, region bounds, old Azure teardown configurations, locked provider installation, and privacy tasks with and without rsyslog. OS and cloud operations are replaced at their boundaries; no cloud resources were created.

Validation: the full Python suite, every prek hook (including dependency audit, Ruff, ty, Ansible lint/syntax, actionlint, and zizmor), and mutation checks for missing SDKs, subscription fallback, region bounds, rsyslog guards, and locked installation.

The compatible SDK pins replace the updates proposed in #15076. See the Azure release and upstream requirements.

Closes #15046.
Closes #15036.
Closes #15037.