Feature request: rtk wrapper for az monitor (log-analytics query is the dominant token sink)

rtk discover flagged az monitor as my top unhandled command. Real numbers from 30 days of Claude Code transcripts (paired tool_use → tool_result by tool_use_id, 686 sessions scanned across all my projects):

Subcommand	Calls	Est. tokens	Avg/call
az monitor log-analytics	385	123,775	321
az monitor metrics	25	4,329	173
az monitor app-insights	20	3,029	151
az monitor activity-log	16	2,511	156
Total az monitor	493	138,448	280

The single dominant bloat source is az monitor log-analytics query. KQL query results return wide JSON tables where each row repeats column names as keys; for time-series queries (typical KQL pattern: summarize ... by bin(TimeGenerated, 1m)) that's massive overhead. A flag (or default) to emit TSV with a one-line header, plus optional column dropping for null-only columns, would cut these in half easily.

Activity-log is much less of an issue than I initially thought (~16 calls, 2.5K tokens total) — real bloat is in log-analytics query.

Suggested wrapper behavior:

• az monitor log-analytics query → emit TSV by default; add --rtk-keep-empty opt-out for null-column preservation
• az monitor metrics list → drop displayDescription, repeat resourceregion/unit only once at the top, not per timeseries
• Pass-through any explicit --query to disable trimming

A generic ARM JSON pruner (filed separately as #1590) would cover ~25% of these savings as a fallback. Happy to defer this issue until that lands if you prefer to layer the work.

Happy to share annotated input/output samples privately if useful.

Methodology note: numbers come from scanning ~/.claude/projects/**/*.jsonl transcripts, pairing Bash tool_use blocks with their tool_result by tool_use_id, stripping any rtk prefix to count like-for-like, and estimating tokens at 4 chars/token.