feat: add GitHub Action for ANC hotfix template injection

[Devinwong]

Summary

Adds a GitHub Action workflow that automatically injects the ANC hotfix version into nodecustomdata.yml. Companion to #8355 (ANC hotfix patch-only matching logic).

Triggers

1. Auto: When hotfix/anc-hotfix-version.json is changed in a PR targeting official/**
2. Manual: Adding the "anc-hotfix" label to any PR

Files

File	Purpose
.github/workflows/anc-hotfix-generate.yml	Workflow with dual triggers (path change + label)
hotfix/anc_hotfix_generate.py	Python script for idempotent injection/removal of hotfix entry in nodecustomdata.yml
hotfix/anc-hotfix-version.json	Version config — empty {} by default, operator sets {"version":"YYYYMM.DD.PATCH"}
AGENTS.md	Added PR review rule: confirm VHD republish before allowing hotfix entry removal

Operational Flow

1. Dalec builds hotfix ANC binary (e.g. 202604.01.1), publishes to PMC
2. Developer merges fix to main (with hotfix entry in nodecustomdata.yml)
3. Cherry-picks to official/* and sets hotfix/anc-hotfix-version.json
4. GH Action auto-injects aks-node-controller-hotfix.json write_files entry into the scriptless CSE section of nodecustomdata.yml
5. Reviewer approves → merge → tag → EV2 deploy

Hotfix Entry Lifecycle

• Hotfix entry must persist on both main and official/* until affected VHDs are republished or out of the 6-month support window
• Scale-up uses the same VHD version (not a newer one), so premature removal leaves old-VHD nodes without the hotfix
• Cleanup is a deliberate operator action, not automatic

Tested Scenarios

• ✅ Injection (empty → version set)
• ✅ Update (idempotent re-injection with different version)
• ✅ Removal (version reset to {} removes stale entry)
• ✅ Validation (rejects invalid version formats)

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds automation to keep nodecustomdata.yml in sync with an ANC hotfix version file for official/* release PRs by injecting/removing a marked write_files entry, plus documentation for reviewer expectations.

Changes:

• Adds a GitHub Actions workflow to run on hotfix/anc-hotfix-version.json updates (and optional label trigger) and commit template updates back to the PR branch.
• Introduces a Python generator that injects/updates/removes a marked ANC hotfix block in parts/linux/cloud-init/nodecustomdata.yml.
• Adds an empty default hotfix version config file and updates reviewer guidance in AGENTS.md.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/anc-hotfix-generate.yml	New workflow to run generator and write template updates back to the PR branch.
hotfix/anc_hotfix_generate.py	New script to validate version and inject/remove an idempotent marked block in the template.
hotfix/anc-hotfix-version.json	Adds default empty version file used as the workflow trigger/config.
AGENTS.md	Adds reviewer checklist guidance about safe hotfix entry removal.