Forward AZURE_REGION_NAME and CB_PLACEMENT_AZURE to tox

The Azure provider reads AZURE_REGION_NAME for its region and the test
framework reads CB_PLACEMENT_AZURE for placement, but neither was
plumbed through the workflow's env: block. Setting either as a repo
secret had no effect — the secret reached GitHub but never got into
the runner process, and so never reached tox or the test code. The
provider silently fell back to its hardcoded `eastus` default,
overriding whatever the secret said.

Add both, gated on `matrix.cloud-provider == 'azure'` to match the
secret-scoping pattern the rest of the Azure block already uses.

.github/workflows/integration-cloud.yaml

@@ -100,10 +100,12 @@ jobs:
           AZURE_SUBSCRIPTION_ID: ${{ matrix.cloud-provider == 'azure' && secrets.AZURE_SUBSCRIPTION_ID || '' }}
           AZURE_SECRET: ${{ matrix.cloud-provider == 'azure' && secrets.AZURE_SECRET || '' }}
           AZURE_TENANT: ${{ matrix.cloud-provider == 'azure' && secrets.AZURE_TENANT || '' }}
+          AZURE_REGION_NAME: ${{ matrix.cloud-provider == 'azure' && secrets.AZURE_REGION_NAME || '' }}
           AZURE_RESOURCE_GROUP: ${{ matrix.cloud-provider == 'azure' && secrets.AZURE_RESOURCE_GROUP || '' }}
           AZURE_STORAGE_ACCOUNT: ${{ matrix.cloud-provider == 'azure' && secrets.AZURE_STORAGE_ACCOUNT || '' }}
           CB_IMAGE_AZURE: ${{ matrix.cloud-provider == 'azure' && secrets.CB_IMAGE_AZURE || '' }}
           CB_VM_TYPE_AZURE: ${{ matrix.cloud-provider == 'azure' && secrets.CB_VM_TYPE_AZURE || '' }}
+          CB_PLACEMENT_AZURE: ${{ matrix.cloud-provider == 'azure' && secrets.CB_PLACEMENT_AZURE || '' }}
           # gcp
           GCP_SERVICE_CREDS_DICT: ${{ matrix.cloud-provider == 'gcp' && secrets.GCP_SERVICE_CREDS_DICT || '' }}
           CB_IMAGE_GCP: ${{ matrix.cloud-provider == 'gcp' && secrets.CB_IMAGE_GCP || '' }}