[BREAKING] FEAT: Add fixed egress deployment for CoPyRIT

[Bashir Partovi (bashirpartovi)]

Description

This PR establishes one supported CoPyRIT Azure topology: a public workload-profiles Azure Container Apps environment on a dedicated delegated subnet, with a Standard NAT Gateway and static public IP for fixed outbound egress. Azure Front Door Premium is optional and uses the public ACA hostname as its HTTPS origin; the direct ACA URL remains available as a documented diagnostic and rollback path.

The Azure DevOps deployment workflow now:

• builds and propagates an immutable image digest;
• validates existing application and network resources before deployment;
• runs a fail-closed ARM what-if validator that rejects malformed results, deletes, cross-resource-group writes, protected-topology changes, and unexpected core-resource creation;
• preserves resource and policy-managed public-IP tags;
• optionally applies a CanNotDelete lock to the static egress public IP and verifies its resource ID and address after deployment;
• validates the Front Door health route;
• keeps production opt-in, test-first, and independently approved.

The isolated-instance lifecycle scripts now validate Azure CLI JSON boundaries, configure SQL and Storage firewalls with the static egress IP, use ownership tags, and require explicit acknowledgement before teardown releases an allow-listed IP.

Breaking change: the existing enablePrivateEndpoint parameter and its Azure Container Apps environment Private Endpoint and private DNS resources are removed, along with the previous Private Endpoint subnet parameters. Existing deployments that use this path must migrate to a parallel VNet-integrated public ACA environment with fixed NAT egress because an ACA environment network type cannot be converted in place. Pipeline callers must adopt the deployment parameters documented in infra/README.md.

Tests and Documentation

• python -m unittest discover -s tests/unit/infra -p 'test_*.py' -q ΓÇö 23 tests pass.
• Compiled infra/main.bicep, infra/modules/aca_nat_network.bicep, and infra/modules/aca_front_door.bicep with Azure CLI/Bicep.
• Ran py_compile for both lifecycle scripts and the what-if validator.
• Ran bash -n for the container startup and deployment scripts.
• Validated both parameter JSON files, README Mermaid rendering, documented Bash fences, no-wrap Markdown formatting, and git diff --check.
• Pylance/editor diagnostics are clean for the changed lifecycle, pipeline, test, and documentation files.
• Updated infra/README.md and infra/DEPLOY_NEW_INSTANCE.md with the supported topology, ingress/egress behavior, migration boundary, pipeline contract, lifecycle safeguards, and teardown requirements.
• JupyText was not run because this change does not modify notebooks.