Fix az-arm.js resolved flag and add CI check to enforce generated file sync

[Copilot]

PR #824 manually edited the generated az-arm.js to set resolved: false for XMSSecretInResponse, diverging from the source az-arm.ts which has resolved: true. There was no CI guard to catch this drift.

Changes

• packages/rulesets/generated/spectral/az-arm.js — Correct resolved: false → resolved: true for XMSSecretInResponse, matching the TypeScript source.

• .github/workflows/test.yaml — Add a Verify generated files are up-to-date step after rush build and rush regen-ruleindex:

  - name: Verify generated files are up-to-date
    run: git diff --exit-code
    shell: bash

  Fails the build if any committed generated file differs from what the build produces, preventing future drift.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.