P1: shared cudly-reservation-role module missing reservationOrders/purchase/action (regression from #744 extension) #762

Summary

The shared Terraform module at terraform/modules/iam/azure/cudly-reservation-role/main.tf is missing Microsoft.Capacity/reservationOrders/purchase/action from its actions list. This is the exact action PR #744 was opened to add — host-side Azure reservation purchases will still 403 with AuthorizationFailed on reservationOrders/purchase/action.

The customer-side ARM template (arm/CUDly-CrossSubscription/template.json) correctly contains the action.

How this was caught

The parity-guard script from PR #761 (scripts/check-azure-role-parity.sh), when run against the current base of feat/multicloud-web-frontend, reports:

ERROR: ARM template and TF module actions lists differ.
Diff (< TF  > ARM):
7a8
> microsoft.capacity/reservationorders/purchase/action

Root cause

When the inline azurerm_role_definition block in iac/federation/azure-target/terraform/main.tf was refactored into the shared module (part of the #744 host-parity extension), the actions list was copied over but Microsoft.Capacity/reservationOrders/purchase/action was dropped.

Fix

Add "Microsoft.Capacity/reservationOrders/purchase/action" to the actions array in terraform/modules/iam/azure/cudly-reservation-role/main.tf, position-sorted to match the ARM template.

Test plan

• Add the action to the shared module
• Run scripts/check-azure-role-parity.sh — should exit 0
• Run terraform validate on the module and its consumers
• Verify host-side container-app identity inherits the correct role after terraform apply