feat(cli) add --ensure-cosmos-containers post-deploy smoke-test

[jkeeley2073]

Summary

Adds a CLI flag that runs CosmosBootstrapper.EnsureCreatedAsync against the configured Cosmos account — creates the pinwiz database + the configured containers if missing, asserts existing partition-key paths match (drift throws). Idempotent. Returns exit code 2 with a clear remediation message when Cosmos isn't configured (the bootstrapper is only DI-registered when AddCosmosPersistence was wired).

Why this exists: before this flag, the closest "is Cosmos working?" smoke-test was --status, but --status reads only the local file catalog and does NOT exercise Cosmos at all. A Cosmos misconfig would surface only on first --source opdb attempt (which requires an OPDB API token to even reach the Cosmos write path).

Also: CosmosOptions.Containers default flips from [] to the canonical Phase 1 list per ADR 0011 — machines (PK /manufacturer) and ingestion_sources (PK /partitionKey). Matches the container names the existing MachineRepository / IngestionSourceRepository registrations already reference; previously the bootstrapper would no-op without an explicit appsettings.json Cosmos:Containers entry.

.gitignore gains infra/*.json to prevent future accidental commits of az bicep build artifacts (caught one in this branch and removed it before push).

Test Plan

• dotnet build PinballWizard.slnx -> 7 / 7 projects, 0 warnings, 0 errors
• dotnet test PinballWizard.slnx -> 501 / 501 passing (was 496 — +5 in CosmosOptionsTests pinning the canonical defaults)
• Live smoke-test post-PR-merge: pwsh ./infra/scripts/Deploy-SharedResources.ps1 -Environment dev then $env:Cosmos__AccountEndpoint = "<endpoint>" ; dotnet run --project src/PinballWizard.Cli -- --ensure-cosmos-containers -> expects "Cosmos database + containers ensured." and the pinwiz database + 2 containers visible in the Azure portal

Out of Scope

• Removing the duplication between CosmosOptions.Containers defaults and the hardcoded "machines" / "ingestion_sources" strings in Persistence/Cosmos/ServiceCollectionExtensions.cs. Future small PR — pull the names into constants on CosmosOptions so the repository registrations reference them too.
• Calling EnsureCreatedAsync automatically at startup. Considered; rejected in favor of an explicit flag so --scrape-only --source jjp doesn't fail at startup if Cosmos is mis-configured (and so the smoke-test is a deliberate operator action, not a side effect of every CLI run).

Checklist

• CI is green
• PR title follows the Conventional Commits format
• If user-visible behavior changes, README.md is updated -> --ensure-cosmos-containers row added to the CLI Flags table; the session-handoff playbook Step 7 updated to use the new flag instead of --status for the post-deploy smoke-test
• No TODO / FIXME / commented-out code committed

Pre-push self-audit

Step 0 — /local-review (qualitative)

• Skipped with justification — single-flag addition with the dispatch mirroring the existing --install-playwright early-exit pattern; the new CosmosOptions defaults are pinned by 5 behavior tests; no architectural surface added.

Step 1 — Mechanical checklist

• Every new *Options property has at least one real getter call in src/ — CosmosOptions.Containers is read by CosmosBootstrapper.EnsureCreatedAsync (lines 52-55)
• Sibling-diffed against the closest existing implementation — dispatch mirrors --install-playwright early-exit pattern (Program.cs:103); error path matches --source opdb exit-code-2 pattern (Program.cs:130-134)
• No bare catch { } — N/A (no catch added)
• New ISourceScraper? — N/A (the flag is a host-resolved bootstrap call, not a scraper)
• Tests assert behavior, not just structure — 5 new tests pin every default field in CosmosOptions against ADR 0011
• Build is zero-warning
• git log -1 --format='%an <%ae>' shows personal noreply, not work email