# PR Description

## Summary

Implements comprehensive testing infrastructure for blueprints with both contract validation and deployment testing capabilities. Introduces reusable test utilities in `src/900-tools-utilities/904-test-utilities` and demonstrates their application in the `full-single-node-cluster` blueprint.

## Changes

### New Testing Framework

- **`src/900-tools-utilities/904-test-utilities/`** - Shared testing utilities package for blueprint validation
  - Contract testing functions for Terraform and Bicep output validation
  - Deployment helpers with automatic cleanup support
  - Framework-agnostic test primitives
  - Comprehensive documentation with usage examples

### Blueprint Testing Implementation

- **`blueprints/full-single-node-cluster/tests/`** - Complete test suite demonstrating framework usage
  - Contract tests for both Terraform and Bicep (fast, zero-cost validation)
  - Deployment tests with full Azure integration
  - Helper scripts (`run-contract-tests.sh`, `run-deployment-tests.sh`)
  - Go test files with output validation logic
  - Detailed README with setup and usage instructions

### Documentation Updates

- **`docs/contributing/testing-validation.md`** - Expanded testing guidance with blueprint testing section
- **`docs/getting-started/blueprint-developer.md`** - Updated developer workflow with testing integration
- **`blueprints/README.md`** - Added testing overview and reference to test utilities
- **`blueprints/full-single-node-cluster/README.md`** - Added testing section with quick start
- **`src/900-tools-utilities/README.md`** - Added 904-test-utilities to component table
- **`docs/_sidebar.md`** - Updated sidebar navigation link

### Infrastructure Fixes

- **Terraform improvements:**
  - Fixed messaging component eventhub module
  - Enhanced output declarations in full-single-node-cluster
- **Bicep improvements:**
  - Aligned full-single-node-cluster blueprint outputs to mirror Terraform's

## Testing Strategy

**Contract Tests (Zero-Cost):**

- Static validation of IaC output declarations
- Executes in seconds without Azure authentication
- Catches configuration drift before expensive deployments
- Uses `terraform-docs` and `az bicep build` for analysis

**Deployment Tests (Full Integration):**

- End-to-end deployment to Azure
- Resource creation and configuration validation
- Kubernetes cluster connectivity verification
- IoT Operations functionality testing

Addresses work item #1840

----
#### AI description  (iteration 5)
#### PR Classification
This pull request adds a new feature by implementing a comprehensive testing framework for blueprint contract and deployment validation.

#### PR Summary
The pull request introduces a complete testing infrastructure for the Full Single Node Cluster blueprint that validates both Terraform and Bicep implementations. It adds end-to-end contract tests, deployment tests, shared test utilities, and updated documentation.
- Added new test suite files (e.g. `te...

…pport for Azure IoT Operations

Added comprehensive container registry endpoint management for Azure IoT Operations, enabling custom registry configuration with multiple authentication methods. MCR (mcr.microsoft.com) is now automatically configured as the default registry endpoint with anonymous authentication, while users can define additional custom endpoints for ACR or other container registries.

- **feat**(_110-iot-ops/bicep_): Added `registryEndpoints` parameter and new `registry-endpoints.bicep` internal module
  - Supports four authentication methods: `SystemAssignedManagedIdentity`, `UserAssignedManagedIdentity`, `ArtifactPullSecret`, and `Anonymous`
  - MCR endpoint (`mcr.microsoft.com`) is always created automatically with anonymous authentication
  - `acrResourceId` field enables automatic AcrPull role assignment when using SystemAssignedManagedIdentity authentication

- **feat**(_110-iot-ops/bicep_): Added new user-defined types in `types.bicep` for type-safe registry endpoint configuration
  - `RegistryEndpointConfig`: Container registry endpoint configuration with name, host, acrResourceId, and authentication
  - `RegistryAuthentication`: Discriminated union type for the four supported authentication methods
  - `SystemAssignedManagedIdentitySettings`, `UserAssignedManagedIdentitySettings`, `ArtifactPullSecretSettings`: Authentication-specific settings types

- **feat**(_110-iot-ops/terraform_): Added `registry_endpoints` variable and new `registry-endpoints` internal module
  - Terraform implementation mirrors Bicep functionality with equivalent authentication methods
  - Added `should_assign_acr_pull_for_aio` field to control automatic AcrPull role assignment
  - Comprehensive variable validation for name format, authentication method requirements, and reserved names

- **feat**(_110-iot-ops_): Added `extension_identity` output from `iot-ops-instance` modules (both Bicep and Terraform)
  - Exposes the AIO Arc extension's `principalId` for use in role assignments
  - Required by the registry-endpoints module for ACR role assignment functionality

- **refactor**(_110-iot-ops_): Removed hardcoded registry endpoint from `iot-ops-instance` modules
  - Registry endpoint creation moved to dedicated `registry-endpoints` internal module
  - Separation of concerns allows for flexible registry endpoint configuration

- **feat**(_blueprints_): Added registry endpoint parameters to `full-single-node-cluster` and `full-multi-node-cluster` blueprints
  - `registryEndpoints` parameter for custom registry configurations
  - `shouldIncludeAcrRegistryEndpoint` parameter to automatically include the deployed ACR as a registry endpoint
  - Multi-node cluster blueprint includes `combinedRegistryEndpoints` logic for merging custom and ACR endpoints

- **test**(_110-iot-ops/terraform_): Added comprehensive test cases for registry endpoints functionality
  - Tests for default empty configuration, single ACR endpoint, multiple endpoints with different authentication methods
  - Variabl...