Add static ARM template validation workflow #9

Evidence

App_Service has ARM/template.json and ARM/parameters.json; current checks parse JSON only and do not validate ARM schema or static best practices. There is no Bicep source. Cloud validation/what-if requires credentials and is explicitly out of scope.

Scope

Research then publish a reusable static ARM validation workflow with pinned schema/tool versions, correct schema dialect for template and parameter files, and a pinned ARM-TTK invocation/failure policy. Preserve the distinction between JSON/schema/static checks and resource-provider or deployment semantics.

Acceptance criteria

• Safe workflow_call path inputs with repository-containment validation; exact pins, no caller shell, contents:read, no cloud credentials/deploy/what-if.
• Parse both JSON files, validate against appropriate ARM schemas, run pinned ARM-TTK with explicit handling of informational/warning tests.
• Regression fixtures for valid/invalid ARM examples; contract tests and immutable-SHA caller example.
• Document limits and reliable failure output.

Add to Project #2 Backlog unassigned before implementation.