Lorrin/20260103 fix platform cd env

[lorrinferdinand-hue]

Environment Variable Binding

• Add environment binding to execute-training-job, enable-storage-access, and execute-ml-job-pipeline jobs
• Enable hybrid variable resolution: environment variables override repository variables when defined
• Preserve repository variables as fallback for jobs without environment binding
• Support multi-workspace architecture per InfrastructureDesign.md recommendations

Storage Access & Authentication

• Fix environment variable scoping in platform_ci_workflow.yml and platform_cd_workflow.yml
• Move critical vars (SUBSCRIPTION_ID, RESOURCE_GROUP_NAME, etc.) to workflow-level env block
• Add validate_storage_rbac.py for local diagnostic testing (~30s vs 10+ min workflow runs)
• Validate endpoint identity storage permissions before deployment

Workflow Trigger Standardization

• Standardize enable_storage_public_access parameter across all model workflows
  • CI: hardcoded true (acceptable for PR/dev environments)
  • CD workflow_dispatch: default true (testing convenience)
  • CD workflow_call: default true (overridable for production)

Documentation

• Add "Storage Network Access Configuration" section to InfrastructureDesign.md
• Document enable_storage_public_access pattern and production networking requirements
• Explain temporary public access trade-offs for dev vs private endpoints for prod
• Provide workflow examples for dev and production deployments

Code Quality

• Fix flake8
• Include RBAC validation steps as needed
• Improve error messages