After multiple discussions, at length, with a senior Azure engineer at Microsoft, the bottom line is "the image is hosed". Because of the way the CentOS (and other Linux) images are built, if you lose the waagent without deprovisioning it first, you will obliterate all access to an elevated privilege account.
Microsoft's Azure team has bumped the request to allow for console level access to the Linux images, but there is no ETA or even a confirmation that this feature will ever be considered.
For now the only answer is "rebuild the system on a new image".