Azure InvalidTemplateDeployment: read the inner error, not the outer message

Error text: `InvalidTemplateDeployment` with a message that says almost nothing.

Get the real error:

```
az deployment group show --resource-group [rg] --name [deployment]   --query "properties.error.details[].message"
```

Common inners:

1. **Parameter type mismatch.** "The provided value ... is not valid" - a string where an int was expected, or a secureString passed as plain text. Check the parameter file types.
2. **apiVersion too old/new.** The resource type does not support a property at the apiVersion you pinned. The error names the property; check the resource provider docs for the apiVersion that introduced it.
3. **Location not available.** "The location ... is not available for resource type" - the SKU does not exist in that region. Move region or SKU.
4. **dependsOn / reference() ordering.** Referencing a resource property before it exists. Bicep's symbolic references handle most of this; raw ARM templates need explicit dependsOn.
5. **Template language expression.** A stray `[` in a string makes ARM parse it as an expression. In Bicep this is rarer; in JSON templates escape as `[[`.

Workflow: `az bicep build` (compile check) then `what-if` (semantic check) then create. Each stage catches a different class; skipping straight to create wastes the 5-minute deployment cycle on syntax errors.