Add network-effective lab parity coverage

[TacoRocket]

Summary

• add network-effective to the lab validator admin command lane
• record manifest expectations for the existing public-VM plus subnet-NSG proof path
• document the added coverage and add focused validator tests for the new branch

Verification

• python3 -m py_compile scripts/validate_azurefox_lab.py tests/test_validate_azurefox_lab.py
• python3 -m unittest discover -s tests -p "test_validate_azurefox_lab.py"
• tofu fmt outputs.tf
• tofu validate
• tofu apply -refresh-only -auto-approve
• python3 scripts/validate_azurefox_lab.py --azurefox-dir "/Users/cfarley/Documents/HarrierOps/Azure/Family AF/AzureFox" --python /tmp/azurefox-live-venv/bin/python --mode full --skip-command role-trusts

Deferred

• keep application-gateway, container-apps, and container-instances as the next resource-backed lab parity lane