Investigate soft delete strategies where necessary

[benbp]

For example, some of the destructive actions our automation might take have built-in soft delete, e.g. with azure pipelines and keyvaults.

We do not have a concept of soft delete for branches (github DOES, but it requires knowing the underlying commits and/or escalating to get event logs). There are also several cases of azure-hosted services that do not have fully automated buildout: apiview, pipeline witness, webhook router, etc. Idempotent re-create may be more appropriate than soft-delete in some cases, but the principal is the same.