test(scriptless): Enable scriptless phase 3 in AB e2es

[lilypan26]

What this PR does / why we need it:

• Enables scriptless phase 3 in ab e2es under tag EnableScriptlessANC
  • This tag means both ANC and NBC cse cmd will be provided, tests should validate that there are no diffs between the generated provisioning env vars
  • For now, NBC cse cmd will be used for provisioning until there are no more diffs, after which we can switch to using ANC
• Adds CustomDataPhase3 to provide both ANC and NBC cse cmd to AKS node controller

Which issue(s) this PR fixes:

Fixes #

[github-actions]

PR Title Lint Failed ❌

Current Title: test(scriptless): Enable scriptless phase 3 in AB e2es

Your PR title doesn't follow the expected format. Please update your PR title to follow one of these patterns:

Conventional Commits Format:

• feat: add new feature - for new features
• fix: resolve bug in component - for bug fixes
• docs: update README - for documentation changes
• refactor: improve code structure - for refactoring
• test: add unit tests - for test additions
• chore: remove dead code - for maintenance tasks
• chore(deps): update dependencies - for updating dependencies
• ci: update build pipeline - for CI/CD changes

Guidelines:

• Use lowercase for the type and description
• Keep the description concise but descriptive
• Use imperative mood (e.g., "add" not "adds" or "added")
• Don't end with a period

Examples:

• ✅ feat(windows): add secure TLS bootstrapping for Windows nodes
• ✅ fix: resolve kubelet certificate rotation issue
• ✅ docs: update installation guide
• ❌ Added new feature
• ❌ Fix bug.
• ❌ Update docs

Please update your PR title and the lint check will run again automatically.

[Copilot]

Pull request overview

Enables “scriptless phase 3” coverage in the AgentBaker e2e suite by adding a new scriptless_anc subtest path that provisions nodes using AKSNodeConfig/aks-node-controller, plus wiring many existing scenarios to provide an AKSNodeConfigMutator.

Changes:

• Added a new scriptless_anc subtest variant and runtime flag (EnableScriptlessANC) to drive scriptless phase-3 execution.
• Refactored/expanded the e2e “aks-node-controller hack” customData generation to optionally include AKSNodeConfig and/or an nbc-cmd script.
• Updated many scenarios to set equivalent AKSNodeConfigMutator fields alongside existing NBC mutators.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

File	Description
e2e/vmss.go	Refactors customData hack generation and wires scriptless ANC + NBC cmd hack paths into VMSS creation.
e2e/types.go	Adds EnableScriptlessANC and adjusts kubelet-config-file detection logic for scriptless ANC scenarios.
e2e/test_helpers.go	Adds scriptless_anc subtest generation and new gating helper.
e2e/scenario_test.go	Adds AKSNodeConfigMutator coverage across many existing scenarios.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

aks-node-controller/app.go:476

• Passing both --provision-config and --nbc-cmd currently triggers compareEnvs, but the function then proceeds to execute the NBC script (because NBCCmd is prioritized) and does not provision from the AKSNodeConfig. If phase 3 intends to compare envs but still provision via ProvisionConfig, the command-selection logic needs to be adjusted (or a separate flag introduced) so both inputs can be present without changing provisioning behavior.

	// If both flags are provided, compare environments before proceeding.
	// This is best-effort and should not block provisioning.
	if flags.ProvisionConfig != "" && flags.NBCCmd != "" {
		slog.Info("ProvisionConfig and NBCCmd both provided, comparing envs")
		compareEnvs(ctx, flags, a.eventLogger)
	}

	var cmd *exec.Cmd
	if flags.NBCCmd != "" {
		if err := applyNodeCustomData(a.getNodeCustomDataPath()); err != nil {
			provisionResult.ExitCode = strconv.Itoa(240)
			provisionResult.Error = err.Error()
			return provisionResult, err
		}

		var err error
		cmd, err = buildCmdFromNBCCmd(ctx, flags.NBCCmd)
		if err != nil {
			provisionResult.ExitCode = strconv.Itoa(240)
			provisionResult.Error = err.Error()
			return provisionResult, err
		}
	}

	// If NBC command is provided, we prioritize it over the aks node config for provisioning.
	if flags.ProvisionConfig != "" && flags.NBCCmd == "" {
		var err error

[Devinwong]

Does that mean if we move into phase 3 in production, we can safely remove the phase 2 tag EnableScriptlessNBCCSECmd? Trying to sort this out here because there will be 2 similar tags.