[leijgao]

Summary

• Validate the existing VNet and deployment subnet regions against workloadRegion, not controlPlaneRegion.
• Allow Discovery control-plane resources to use a different region while keeping the VNet/subnets and all managed-resource-group resources in the workload region.
• Stop deployment before Bicep or ARM submission when a subnet VNet is in the wrong region or its region cannot be read.
• Update remediation guidance, schema/template descriptions, documentation, and regression tests.

Validation

• 61 Pester tests passed across Stage1Config, Stage4State, DryRun, and DeploymentRegression suites.
• Bicep build completed and the generated ARM template was refreshed.
• PowerShell parser checks, config schema validation, and git diff --check passed.
• No live Azure deployment performed.