feat: dual-push to ECR and ACR, deploy to Azure Container App (PINA-8941 WP2)

[ClaraTschamon]

Summary

Part of PINA-8941 WP2 — adds ACR push and Azure Container App deployment alongside the existing ECR push.

• Builds the image once, tags it for both ECR and ACR
• Pushes to ECR (unchanged)
• Logs in to Azure via service principal, pushes to treelyyieldtablesstaging.azurecr.io
• Runs az containerapp update to deploy the new image to the staging Container App

Prerequisites

The terraform PR for the apps workspace must be applied first — it creates the service principal and stores AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID as secrets in the ecr-push GitHub environment.

Test plan

• Terraform apps workspace applied (secrets visible in ecr-push environment)
• Push to main triggers this workflow
• Image appears in both ECR and treelyyieldtablesstaging.azurecr.io
• az containerapp update succeeds, Container App serves the new image

🤖 Generated with Claude Code

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
src/openyieldtables
__init__.py	0	0	100%
yieldtables.py	73	0	100%
src/openyieldtables/classes
__init__.py	0	0	100%
data_management.py	42	5	88%	40, 47, 76, 89, 95
src/openyieldtables/models
__init__.py	1	0	100%
yieldtable.py	37	0	100%
src/openyieldtables/utils
__init__.py	1	0	100%
utils.py	15	0	100%
TOTAL	169	5	97%