CI/CD into Private Network Boundaries

Deploying to a private ASE without a VNet agent: let the app fetch its own package

A Logic Apps Standard walkthrough swaps the Kudu push for a blob URL the app reads with its own identity. Six failures later, no SAS token exists, and the widest grant is the one nobody reads twice.