Untagged Azure resources: find them today, enforce tags as code tomorrow

Every Azure estate drifts into untagged chaos. Two moves any admin can run this week: find every untagged resource with one query, then stop it happening again with a policy defined as code.