Azure: unimplemented features surfaced by the deep-sweep (real-user e2e)

[NitinKumar004]

Greenfield features the Azure real-user deep-sweep flagged (distinct from the behavior bugs, which are fixed). Each is a new resource type / data-plane surface, not a broken behavior — to build as a scoped feature pass.

• Event Hubs (namespaces / hubs / consumer groups / send-receive) — entirely unimplemented
• Resource locks (Microsoft.Authorization/locks) — CanNotDelete/ReadOnly at RG + resource scope, with enforcement
• Network gateways — Virtual Network Gateways, Local Network Gateways, Gateway/ExpressRoute Connections
• Application Security Groups (Microsoft.Network/applicationSecurityGroups) + NIC ASG association
• SQL Transparent Data Encryption (TDE) — PUT/GET on the databases/{db}/transparentDataEncryption sub-resource
• Azure Monitor autoscale settings (Microsoft.Insights/autoscalesettings)
• Azure Monitor Activity Log queryable data-plane (Microsoft.Insights/eventtypes/management/values)
• App Service deployment slots (Microsoft.Web/sites/slots)
• VMSS instance orchestration — enumerable/addressable/controllable VM instances driven by capacity (+ upgradePolicy/networkProfile enforcement)
• User-assigned managed identities standalone resource (Microsoft.ManagedIdentity/userAssignedIdentities)
• Dedicated Tags resource-provider API (Microsoft.Resources/tags/default)
• Private Link / Private Endpoint surface (Microsoft.Network/privateEndpoints, privateLinkServices)
• Availability Sets / Proximity Placement Groups / Dedicated Hosts (Microsoft.Compute) + fault/update-domain placement
• Public IP Prefixes (Microsoft.Network/publicIPPrefixes)
• Event Grid generic scope-bound eventSubscriptions (on RG/subscription scope)
• Managed image directly from a disk (no VM capture)