surjective deployment subscription mappings
- deployment subscription references have surjective map to subscriptions defined in subscriptions.yml
- subscription references elsewhere (eg puff_map, service_principals, static_secrets) have injective map to subscriptions.yml