Prescriptive architecture patterns for multi-subscription Azure estates — enterprise zero trust enforcement for regulated and high-assurance environments.