fix(substrate): the capz snapshot-store identity holds Storage Blob Delegator on the account

[QuentinBisson]

Problem

Substrate 1.1.0's golden tag copies the golden snapshot's objects server-side, and s3proxy signs the copy source with a user delegation SAS. Generating that key is an account-level action; the capz identity holds Storage Blob Data Contributor on the container only, so on glean every copy fails with AuthorizationPermissionMismatch and no AgentTemplate reaches Ready (giantswarm/giantswarm#37705).

Change

A second Crossplane-managed RoleAssignment gives the identity Storage Blob Delegator on the storage account, the role whose only action is generateUserDelegationKey. make verify-substrate-store asserts the assignment and its scope.

[circleci-architect]

Published Helm chart agent-platform

4.72.2-rdfd82c3at20260924235122hdfc9e2e

Chart	agent-platform
Version	4.72.2-rdfd82c3at20260924235122hdfc9e2e
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform:4.72.2-rdfd82c3at20260924235122hdfc9e2e
Digest	sha256:3f969aee2f133427167b714d87aaaf5a81a937c3270c089e3780d6766fc63ea8
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform --version 4.72.2-rdfd82c3at20260924235122hdfc9e2e

_{Posted by architect-orb · build 13711 · commit dfc9e2e · updated in place on every push}

[circleci-architect]

Published Helm chart agent-platform-connectivity

4.72.2-rdfd82c3at20260924235122hdfc9e2e

Chart	agent-platform-connectivity
Version	4.72.2-rdfd82c3at20260924235122hdfc9e2e
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity:4.72.2-rdfd82c3at20260924235122hdfc9e2e
Digest	sha256:229693eb66ae7e6fcfa3cbd11c59803f4d36684f68f056b1de3aed1f8436f014
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity --version 4.72.2-rdfd82c3at20260924235122hdfc9e2e

_{Posted by architect-orb · build 13712 · commit dfc9e2e · updated in place on every push}