[kchandan]

First of six PRs for the azure-labs pack (an alternative to Azure Lab Services, simulated with standard Azure VMs; not Microsoft's service). Design: docs/azure-labs-plan.md.

What this adds

• labagent launch azure-labs with two steps: preflight and network.
  • preflight: az login, subscription allow-list (LABAGENT_ALLOWED_AZURE_SUBSCRIPTIONS, empty means refuse), size allow-list, student cap, vCPU quota by family and region (peak of the template phase and the class phase).
  • network: tagged resource group rg-labagent-azure-labs-<name>, VNet, gateway subnet (443 only), student subnet (22 and 3389 only from the gateway subnet), through an ARM template.
• labagent destroy azure-labs: deletes only resources that carry this lab's tags, dependants first, then the group only if labagent created it and it is empty. An untagged or differently tagged resource is reported and never deleted.
• labagent sweep-azure plan | apply --plan F --hash H: expired labs only, plan hash, 24 hour plan age, re-checks tags at apply time, skips images groups.
• labagent launch --pubkey FILE (or LABAGENT_PUBKEY), labagent secrets keygen | decrypt, and a per-pack password kind in the envelope. Passwords are not created yet; the key is required once the publish step lands (PR 3).
• All Azure calls go through the az CLI. Secrets never go on a command line: ARM parameters use a 0600 temp file that is deleted after. Errors are redacted.

Tests

• 534 passed, 3 skipped (Python 3.9, macOS). New: tests/test_azure_labs.py (42 tests, fake az).
• The NL prompt budget test went from 2500 to 3000 characters: one more pack adds about 300. I did not re-measure the translator's accuracy with 7 packs.
• Read-only checks against a real subscription passed: login, usage, size families, group lookups, tag listing, quota arithmetic (3 x B2s fits; D2s_v5 is refused because that subscription's Dsv5 quota is 0).
• Not run on Azure yet: creating the group and network, and destroy. Those are covered only by the fake. The first real run is test 4 of docs/azure-labs-plan.md.
• The size list call takes about a minute (az vm list-skus filters on the client). The pack says so.

Resources this PR creates on Azure: one resource group, one VNet, two NSGs. No compute, no public IP.

🤖 Generated with Claude Code

[kchandan]

Superseded by a smaller pack: #29. This one added an expiry sweep and key handling that were not needed.