feat: name Sites built from typed inputs after their cluster

[Paymaun (digimaun)]

Summary

• Without siteName, a Site built from a cluster ID takes the cluster's name in lowercase, so the cluster plant-a deploys as the Site plant-a. When the cluster's name is not a valid Site name, the command stops after reading the cluster, before any deployment, and asks for --input siteName=<name>. Redacted output omits the cluster name.
• The schema registry namespace must be unique in the Microsoft Entra tenant. schema-registry.bicep gains useScopedSchemaRegistryNamespace, off by default, which adds a hash of the resource group and registry name to the namespace. The AIO install contract turns it on for every Site built from typed inputs, so clusters that share a name in different resource groups keep distinct namespaces. Configured Sites keep their existing namespace behavior.
• The docs describe the naming rule, the new error, tenant uniqueness for Sites you write yourself, rebuilding a Site for a registry created without the setting, and granting your account a Key Vault data role to view Secret Sync secrets in the IoT Operations portal.

Compatibility

Existing installations keep their schema registry namespaces when you redeploy them from their Site files, because a Site file without useScopedSchemaRegistryNamespace keeps the original naming. Typed inputs for AIO installation are new in this release, so every installation from an earlier public release came from a Site file.

A registry's namespace is fixed when the registry is created. To rebuild a Site through typed inputs for a registry created without the setting, save the Site, set useScopedSchemaRegistryNamespace to false and deploy with --site-file, as the Site configuration guide describes. The Site file route covers this case, so the contract adds no input for it. Tests cover an explicit false through saving, loading and preparation.

Validation

• Unit suite with the CI invocation on Windows, and scripts/validate-bicep.ps1.
• Tests cover lowercase names, names that need siteName, redaction, the flag reaching only the schema registry step, and saving and reloading Sites.
• Live check on two Arc clusters both named plant-x in different resource groups, deployed without siteName: both plans showed the Site plant-x, both deployments succeeded, and the two schema registry namespaces differed. Redeploying from the saved Site succeeded and kept its namespace.

[Copilot]

🔵 Needs a closer look

Immutable schema registry namespace changes warrant human review after the pending live deployment and redeployment validation completes.

No open issues 🎉

What changed in this PR

Updates Site Ops typed inputs to default Site names to lowercase cluster names, with scoped schema registry namespaces to distinguish same-named Sites across resource groups.

Changes:

• Replaces hashed Site names with validated cluster names and actionable override errors.
• Enables scoped namespaces for typed-input AIO installations while preserving Site-file defaults.
• Adds regression coverage and documents naming, compatibility, and Key Vault access.

File	Description
workspaces/​iot-operations/​templates/​deps/​schema-registry.bicep	Adds optional scoped namespaces with legacy defaults.
workspaces/​iot-operations/​manifests/​secretsync/​inputs.yaml	Clarifies the default Site name.
workspaces/​iot-operations/​manifests/​aio-install/​inputs.yaml	Enables scoped namespaces for typed inputs.
tests/​workspace/​test_aio_release_behavior_contracts.py	Checks namespace construction and limits.
tests/​test_guided_inputs.py	Covers lowercase names, validation, and overrides.
tests/​test_guided_cli.py	Covers parameter routing, persistence, and fleet selection.
siteops/​guided_inputs.py	Derives and validates resource-based Site names.
siteops/​cli.py	Updates input help for naming defaults.
docs/​troubleshooting.md	Explains invalid-name errors and remediation.
docs/​site-configuration.md	Documents namespace compatibility and recovery.
docs/​secret-sync.md	Documents user access to Key Vault secrets.
docs/​manifest-reference.md	Updates the resource-derived naming contract.
docs/​guided-inputs.md	Explains naming defaults and project uniqueness.

_{Review effort: Balanced}