Feature/vm deploy - #3

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@vm-deploy/ansible/playbooks/applications.yml`:
- Line 48: The SQL install task is masking failures by setting failed_when to
false, which prevents sql_install_result.failed checks from ever becoming true.
Update the SQL Server installation flow in the playbook so the follow-up debug
and fail tasks key off the command return code from the sql install result
instead of the failed flag, and remove the error-suppression behavior from the
install step. Keep the logic centered around the SQL install task and the
sql_install_result checks so actual installation failures surface correctly.
- Line 7: The `sql_admin_password` variable is currently allowed to fall back to
an empty string, which can break SQL Server setup and later `sqlcmd`
authentication. In `applications.yml`, add an early validation step before the
install/connect tasks that checks `sql_admin_password` is set and non-empty, and
fail fast with a clear message if it is missing. Use the `sql_admin_password`
variable and the existing SQL Server install/connect tasks as the place to wire
this guard in.
- Around line 88-98: The SQL admin login task leaks the SA password on the
command line and directly embeds an Ansible variable into the PowerShell script.
Update the `Create SQL admin login for SQL Authentication mode` `win_shell`
block so `sql_admin_password` is passed safely via an environment variable or
stdin to `sqlcmd`, and avoid interpolating it directly into the script text.
Also keep the existing escaping around `sql_admin_username` in the
`$safeSqlAdmin` / `$safeSqlAdminLiteral` logic, and use a safely sourced
`$saPassword` value instead of assigning it from `{{ sql_admin_password }}`.

In `@vm-deploy/deploy.ps1`:
- Around line 205-220: The deploy script currently relies on terraform being
available and on Write-Error, which does not stop execution. In deploy.ps1,
before calling terraform in the try block around Ensure-AzLogin, add a preflight
check that verifies terraform is on PATH and fail immediately with a terminating
error if it is missing. Also change the terraform init and terraform `@tfArgs`
failure handling so a nonzero exit code stops the script instead of falling
through to the next command.

In `@vm-deploy/main.tf`:
- Line 170: The current $playbookArgs construction in the deployment flow
exposes ansible_password and sql_admin_password on the command line; update the
ansible-playbook invocation to stop passing sensitive values inline. In the
logic that builds and executes the Linux and WSL paths, write the extra vars to
a temporary file with restricted permissions, switch the command to use
--extra-vars @<temp file>, and ensure the temp file is deleted afterward in both
branches. Keep the fix localized around the $playbookArgs / ansible-playbook
execution code so the credentials never appear in process listings.
- Around line 6-8: The resource naming in the main Terraform locals is using
plantimestamp(), which makes date_suffix change on every new plan and forces
full replacement of Azure resources. Update the local values used by
resource_prefix and resource_group_name to rely on a stable identifier instead
of plantimestamp(), such as a new suffix variable or a random_string-style
persistent value, so the names remain consistent across applies and do not
trigger unnecessary recreation.

In `@vm-deploy/README.md`:
- Around line 53-59: Update the Deploy section in the README to document the
deploy.ps1 wrapper script alongside the existing Terraform commands. Add
examples using the deploy.ps1 entry point (including the interactive menu and a
non-interactive apply invocation with -OsVersion, -Action, and -AutoApprove) and
then keep the manual terraform init/plan/apply commands as a separate “Manual
Terraform commands” option. Make sure the section references deploy.ps1 clearly
so users can discover the OS selection menu, auto-approve flow, and Azure login
preflight.

In `@vm-deploy/variables.tf`:
- Around line 100-105: The `sql_admin_password` variable in `variables.tf`
currently defaults to an empty string even though mixed-mode auth is always
enabled, so add a validation block on `sql_admin_password` to require a
non-empty value. Update the `variable "sql_admin_password"` definition to reject
`""` (and other blank values if applicable) with a clear error message, so
deployments using this input cannot accidentally create a SQL login with an
empty password.

In `@vm-deploy/versions.tf`:
- Around line 5-8: The AzureRM provider constraint in the terraform versions
configuration is still pinned to the 3.x line, which is deprecated; update the
azurerm version constraint in versions.tf to a 4.x-compatible range, and verify
any dependent resources or modules in the vm-deploy stack are adjusted for the
new provider behavior, using the azurerm block as the main locator.

---

Nitpick comments:
In `@vm-deploy/ansible/requirements.yml`:
- Around line 1-4: The Ansible collections in requirements.yml are currently
unpinned, which can make installs non-reproducible. Update the collection
entries for ansible.windows and chocolatey.chocolatey to include explicit
version constraints that match the compatible Ansible runtime. Keep the change
in requirements.yml so ansible-galaxy collection install always resolves the
same versions.

In `@vm-deploy/main.tf`:
- Around line 198-201: The WinRM-related resource block is missing the subnet
NSG association in its dependency chain, so `depends_on` only waits for
`azurerm_network_security_rule.allow_winrm` and
`azurerm_virtual_machine_extension.winrm_https`. Update the `depends_on` list to
also include the NSG-to-subnet association resource used in this module so the
association is guaranteed before Ansible connects, and keep the change localized
to this VM deployment resource.
- Around line 128-130: The WinRM bootstrap command in protected_settings lacks
fail-fast error handling, so failures in the certificate creation path can be
masked. Update the commandToExecute PowerShell sequence to stop on errors by
setting $ErrorActionPreference to Stop, then explicitly verify the result of
New-SelfSignedCertificate before using $cert.Thumbprint; if the certificate is
missing or null, abort the script so the extension fails instead of reporting
success. Use the commandToExecute block in protected_settings to locate the fix.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@vm-deploy/deploy.ps1`:
- Around line 78-82: Rename the helper to use an approved PowerShell verb while
keeping the same preflight behavior: change Ensure-TerraformInstalled to
Assert-TerraformInstalled, and update any call sites in deploy.ps1 that invoke
this helper so they match the new name. Keep the existing
throw-on-missing-Terraform logic unchanged.