[2/3] Harden E2E state, cleanup, and Arc diagnostics

[Alex Huang (wenhug)]

Summary

• isolate every E2E attempt with deterministic names and ownership metadata
• persist deployment state atomically and preserve it until cleanup is verified
• make Azure cleanup fail closed, bounded, idempotent, and safe under partial deployment
• handle AKS-managed node resource groups and legacy untagged OS disks
• upload sanitized cleanup diagnostics and retain failed-attempt state
• pin and recover the exact Kubernetes patch version across commands
• verify the Arc principal, role, cluster scope, and role action before persisting assignment state
• report bounded, redacted ARM error details and periodic Arc authorization health while bootstrap data is retried

Stack

• Depends on [1/3] Restrict Flex Node bootstrap token RBAC #287.
• This is part 2 of the replacement for Restrict Flex Node bootstrap token RBAC #286.
• Followed by [3/3] Test historical bootstrap RBAC migration #289, which contains the historical v0.1.0 migration scenario.

This branch targets wenhug/bootstrap-rbac-core so the review shows only E2E hardening and Arc bootstrap diagnostics. After #287 merges, it will be rebased and retargeted to main.

Scope

Successful shipped Flex Node behavior is unchanged. The bootstrap-data client now exposes only allowlisted, size-bounded, control-character-sanitized ARM error fields and request IDs on failed HTTP responses. The remaining changes are E2E state, infrastructure, cleanup, verification, and test code.

The extensive tests use fake Azure commands to exercise ownership validation, retries, concurrency, partial provisioning, residual detection, deletion ordering, role-assignment verification, and secret-safe failure reporting.

Validation

• make check
• go test -race ./hack/e2e
• go test -race ./pkg/bootstrapdata
• Bicep compilation
• workflow YAML parsing
• ShellCheck and bash -n
• independent pre-push scope, correctness, and security audit