Initialize-TssSdkClient robustness bundle: brittle success detection, .NET 4.6+ note, dead ContainsKey guards

[jagger]

Summary

Three small robustness gaps in Initialize-TssSdkClient.ps1 surfaced during the 0.62.1 release review. Grouping them here because they all live in the same cmdlet and would be picked up together in a single follow-up PR.

1. Success detection is a strict-equality against a hardcoded English string

File: src/functions/authentication/Initialize-TssSdkClient.ps1:137

if ($tssInitOutput -eq 'Your SDK client account registration is complete.')

Any trailing newline, carriage return, or locale-translated SDK message causes the success path to be silently missed (no Write-Host, no failure surfaced either). $tssInitOutput is the concatenation of stdout + stderr with no trimming.

Proposed fix: use -match on a pattern (e.g. 'account registration is complete') and/or check $tssProcess.ExitCode -eq 0. Trim the output before comparing.

2. -ConfigPath whitespace validation was dropped without documenting the .NET 4.6+ requirement

File: src/functions/authentication/Initialize-TssSdkClient.ps1:47-51

The 0.62.1 fix moved from ProcessStartInfo.Arguments (string) to ProcessStartInfo.ArgumentList (Collection). .NET handles per-arg quoting via PasteArguments, but that API only became correct in .NET Framework 4.6+ / .NET Core 2.0+. The module manifest requires PowerShellVersion = '7.2.11', which sits on .NET 6+, so in practice there's no live host where this breaks — but the manifest reads CompatiblePSEditions = 'Desktop', 'Core' (tracked separately in #468). Worth a note in the cmdlet's .NOTES or in a follow-up docs pass.

Proposed fix: add a .NOTES line to the cmdlet explaining that argument quoting relies on the .NET 4.6+ PasteArguments implementation, and confirm PS 5.1 hosts (if ever restored) would need at least .NET 4.6.

3. Dead ContainsKey guards on mandatory parameters

File: src/functions/authentication/Initialize-TssSdkClient.ps1:106, 110, 118

-SecretServer, -RuleName, and -ConfigPath are all [Parameter(Mandatory, ParameterSetName = 'init')]. The if ($tssParams.ContainsKey('SecretServer')) { ... } guards are unreachable falsy branches — the params must be present when the code runs. Only OnboardingKey (line 114) has a real optional guard.

Proposed fix: drop the guards on the mandatory params. Keep OnboardingKey's check.

Discovery

Consolidated PR review of v0.62.0 → dev (0.62.1 candidate).