#3061 [comp] Production Deploy

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Adds TLS 1.2 enforcement checks for Azure MySQL and PostgreSQL Flexible Server, and fixes CloudWatch metric-filter auto-fix by pinning the real CloudTrail log group. Also upgrades remediation models for more reliable auto-fix plans.

• New Features

  • Added mysqlFlexibleTlsCheck for Microsoft.DBforMySQL/flexibleServers; compliant when require_secure_transport is ON and tls_version permits only TLSv1.2+ (e.g. TLSv1.2,TLSv1.3); mapped to the TLS/HTTPS task and exported in checks/index.ts and azure/index.ts.
  • Added postgresqlFlexibleTlsCheck for Microsoft.DBforPostgreSQL/flexibleServers; compliant when require_secure_transport is ON and ssl_min_protocol_version is TLSv1.2/1.3 or unset; mapped to the TLS/HTTPS task and exported in checks/index.ts and azure/index.ts.

• Bug Fixes

  • CloudWatch metric-filter auto-fix: surface the real trail log group in evidence (cloudWatchLogGroupName for missing-filter, or the filter’s logGroupName), and force it onto every PutMetricFilterCommand in preview and execute; updated prompt guidance accordingly.
  • PostgreSQL TLS check: treat an unset ssl_min_protocol_version as compliant and surface config read failures as “Could not verify”.
  • Remediation models: upgraded to claude-opus-4-8 (primary) and claude-sonnet-4-6 (fallback) to improve plan reliability.