feat(deploy): add -HybridAgentPrincipalId param to Deploy-Azure.ps1

Wires the on-prem HybridAgent SPN/UAMI object ID through to the Bicep
parameter so the producer pivot RBAC (queue-scoped SB Data Sender +
key-scoped KV Crypto User on agent-seal) is applied in a single
idempotent deploy.

Usage:
  .\Deploy-Azure.ps1 -EnvironmentName dev3 \`
    -HybridAgentPrincipalId <agent-sp-object-id>

Verified on dev3: agent SP c1460adb-... now has Sender on
dek-sealed-batches queue and Crypto User on the blkmon-agent-seal key
(both least-privilege scoped).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: robgrame

Deploy-Azure.ps1

@@ -73,6 +73,7 @@ param(
     [string]$EnvironmentName = 'dev',
     [string]$SqlAdminPrincipalId,
     [string]$SqlAdminLoginName,
+    [string]$HybridAgentPrincipalId,
     [switch]$SkipPreview,
     [switch]$SkipDeploy,
     [switch]$PublishApps,
@@ -157,6 +158,9 @@ $paramObj = @{
         sqlAdminLoginName    = @{ value = $SqlAdminLoginName }
     }
 }
+if ($HybridAgentPrincipalId) {
+    $paramObj.parameters.hybridAgentPrincipalId = @{ value = $HybridAgentPrincipalId }
+}
 $paramFile = Join-Path $env:TEMP "blkmon-params-$EnvironmentName.json"
 $paramObj | ConvertTo-Json -Depth 10 | Set-Content -Path $paramFile -Encoding utf8
 
@@ -165,6 +169,9 @@ Write-Host "    location             = $Location"
 Write-Host "    principalId          = $principalId"
 Write-Host "    sqlAdminPrincipalId  = $SqlAdminPrincipalId"
 Write-Host "    sqlAdminLoginName    = $SqlAdminLoginName"
+if ($HybridAgentPrincipalId) {
+    Write-Host "    hybridAgentPrincipalId = $HybridAgentPrincipalId"
+}
 Write-Host "    parameters file      = $paramFile"
 
 # --- 4. Bicep build (lint + compile) -----------------------------------------