[yeongseon]

Summary

Prevent the Azure deployment command from printing its result, which includes the Application Insights connection string.

Changes

• Pass --output none to the Bicep deployment command.
• Add a YAML-parsing regression guard requiring output suppression and rejecting debug output.

Validation

• Guard failed before the workflow change and passed afterwards.
• make check-all and make build passed with Hatch Python 3.11.15.
• Exact pytest summary: 879 passed, 4 skipped, 4 deselected, 12 warnings in 13.70s; coverage 96.26%. Two skips require Python 3.12 features; two require azure_functions_worker.
• az bicep build --file infra/main.bicep --outfile /tmp/opencode/logging-625-main.json passed with existing BCP318 nullable-resource warnings.
• Not run: a dispatched Azure deployment and inspection of its logs. That acceptance item remains unmet; this PR must not close the issue yet.
• Security-sensitive disclosure change requires current-head review and commit-bound human maintainer authorization under the existing policy. No human authorization is claimed.

Related Issues

Refs #625

[yeongseon]

Reviewed the output-suppression guard and YAML regression against head 599eece. The workflow supports workflow_dispatch but always performs Azure OIDC login, creates a resource group and deploys infrastructure; it has no offline/log-check-only input. No dispatch was attempted under the explicit no-cloud-command instruction. The live dispatched log proof remains outstanding in #625, so this PR correctly uses Refs #625. Merge authorized by the maintainer’s explicit instruction; authorization applies to the reviewed output guard and regression, subject to all exact-head required checks and resolved conversations. Updating from main requires fresh CI before merge.

[yeongseon]

Final review covers exact head 3e0fd19 after the main update. All five required contexts (bandit, semgrep, Analyze, PR title, ci-required) are completed/success on that SHA; no unresolved review threads. The diff still contains only --output none and its YAML regression. Merge authorized by the maintainer’s explicit instruction. Live Azure dispatch/log inspection remains unperformed because it requires credentials and creates cloud resources; Refs #625 is retained.