[Andreas Schwarz (ASchwarz1984)]

Summary

• Add single-resource-group Hackbox Console automation and a documented manual deployment route, with stable learner-friendly naming, safe retries, readiness verification, and host/guest credential delivery.
• Harden host and nested-guest provisioning, managed-identity permissions, reboot sequencing, and pinned WinGet installation, including bounded transient HTTP download retries.
• Deploy two Basic SKU Bastion hosts independently of host VM startup while preserving network prerequisites and the final readiness gate.
• Update migration/replatforming guidance, subscription Owner requirements, policy-enabled Defender guidance, and Challenge 7 monitoring setup, including a companion Bicep template and clear Observability/SRE agent distinctions.
• Restore deployment sources to microsoft/MicroHack:main and remove unpublished-development guidance and personal testing-source settings.

All changes are confined to 03-Azure/01-03-Infrastructure/06_Migration_Secure_AI_Ready.

Deployment considerations

• Use the matching upstream automation package after this PR merges. Already verified Console labs retain their existing workloads and learner progress.
• Hosted organizers must select resourcegroup-with-subscriptionowner as documented; learner subscription Owner access is not isolation from other learners in a shared subscription.
• Basic Bastion creates two paid hosts. The Console deployer also applies the documented training RG tags SecurityControl=Ignore and CostControl=Ignore; these are not universal policy exemptions and do not stop billing.
• Monitoring alert identities remain RG-scoped. No standalone Observability Agent or Azure SRE Agent resource is required or deployed by the lab automation.

Validation

• Bicep compilation and 122 compiled-template assertions covering dependency ordering, preserved resource configuration, SKU variants, and disabled-Bastion behavior.
• Local mocked fixture runs: 192 hosted-deployer cases, six manual-deployment cases, 36 WinGet cases, and 35 Challenge 7 cases.
• Parser, source-reference, and whitespace checks for the changed surfaces. Local validation did not create or modify Azure resources.

[github-actions]

✅ PR Compliance Check Passed

All compliance checks passed for the latest commit.

Check	Result
📋 Challenges & Walkthrough structure	✅ OK
🔗 Links & images	✅ OK (13 file(s))

📄 Full report in the workflow run summary

---

This comment was automatically generated by the PR Compliance Check workflow.