fix(azure): check VM size availability at plan time

[rishabkumar7]

Closes #99

Changes

azure/main.tf

• Adds the azapi provider (Microsoft's, ~> 2.13), used only to query Microsoft.Compute/skus for the requested VM size. azurerm has no data source for SKU availability. It authenticates with the same az login credentials.
• Three preconditions on the VM, so terraform plan fails early with a readable message when the size:
  • is not offered in the region,
  • is restricted for the subscription (NotAvailableForSubscription, the common Azure for Students SkuNotAvailable case),
  • is Arm64 (the lab uses an x64 Ubuntu image).
• Bootstrap dpkg lock timeout raised from 120s to 300s to match AWS (fix(aws): pick an AZ that offers the instance type and wait for apt lock #134) and GCP (fix(gcp): pick a zone that offers the machine type and wait for apt lock #135).

TROUBLESHOOTING.md

• SkuNotAvailable section now explains the plan-time messages, lists x64 sizes that work, and warns about Arm64 sizes.
• New sections: Azure for Students errors (allowed-region policy, credits used up) and Resource group already exists.

azure/README.md

• The Student note now points to the in-repo section instead of the external Spot-instance guide. That guide recommends Standard_DC1s_v2, which is no longer listed in eastus, eastus2, westus2, or centralus.

Testing

terraform fmt -check and terraform validate pass (azurerm 5.x, azapi 2.13.0).

Plan-level (non-Student subscription):

Case	Result
Defaults (Standard_B1s, East US)	Plans normally
az_region="East US 2"	Plans normally (display name converts to eastus2)
Standard_D1 (NotAvailableForSubscription on this subscription)	Stops: "not available for your subscription"
Standard_B2pts_v2	Stops: "is Arm64, but the lab uses an x64 Ubuntu image"
Standard_Nope	Stops: "not offered in East US"

Full deploy (release mode, Standard_B1s, East US):

• Apply succeeded; setup.done present.
• Password SSH as ctf_user works, including with public-key auth disabled on the client.
• CTF test suite against the deployed lab: 28 passed, 0 failed.
• The apt lock race didn't occur on this boot, so the lock-wait path wasn't exercised.
• Lab destroyed afterwards.

Notes

• Not tested on a real Azure for Students subscription. The restriction check was exercised with Standard_D1, which carries the same NotAvailableForSubscription restriction type.
• The plan now needs read access to Microsoft.Compute/skus and adds a few seconds for the lookup.

[Copilot]

Copilot review overview

🟡 Changes recommended

Missing SKU architecture metadata is mishandled, and several troubleshooting commands may inspect or delete resources in the wrong subscription.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Handle null CpuArchitectureType before error interpolation · New
• Query inherited policies in Terraform's target subscription · New

What changed in this PR

Adds Azure VM SKU preflight validation and improves deployment troubleshooting.

Changes:

• Queries SKU availability and architecture using AzAPI.
• Extends apt lock timeouts.
• Expands Azure troubleshooting guidance.

File	Description
azure/​main.tf	Adds SKU checks and timeout updates.
azure/​README.md	Links Azure Students guidance.
TROUBLESHOOTING.md	Documents Azure deployment failures.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation and documentation are consistent, validated, and have no unresolved issues.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Handle null CpuArchitectureType before error interpolation
• Query inherited policies in Terraform's target subscription