Release v20260722.00-lb-tagged-ip-dual-frontend

Phase 1: Force NSGs + configureServiceSecrets on latest master (107 commits forward)

Changes

8368479 Remove forceNSGs early-return; regenerate assets on latest master Phase 1: Force NSG deployment but keep configureServiceSecrets running so RP VMSS instances become healthy during deployment.
2c66a0b Fix template ipTags ordering bug: use targeted regex for VMSS PIPs
43a7a12 Add portal_in_tagged NSG rule and fix tagged portal container port bindings
de3feae Fix TestCleanupOrphanedTaggedPIPs: use plain error for non-404 case
76c60a2 Fix test failures: make forceNSGs a deployer struct field
0c2b9ee Add orphaned tagged PIP cleanup and NSG-only predeploy mode
6f50af1 Add IP tags to RP and Gateway VMSS public IPs
5826d09 Add portal SSH tagged LB rule and rename portal-probe-tagged
b85d905 Fix missing regexp import in deploy generator templates
cc6cc88 Add tagged public IPs to RP load balancer with dual-frontend rollback support
8764571 Merge pull request #4960 from Azure/linisusan/ARO-26771-muo-image-update
83d426b Merge pull request #4911 from Azure/linisusan/ARO-26365-aro-26372-credscan-suppress-false-positives
4f9c65b Merge pull request #4901 from Azure/linisusan/ARO-26376-removing-insecure-hostkeycallback-implementation
392df48 Merge pull request #4984 from Azure/hawkowl/npm-audit-fix-jul21
3a9edd5 npm audit fix
2c8253b Fix CredScan false positives for pullsecret and vendor swagger.
e0107e2 Fix CredScan suppression path for extract_test.go
ee4fd5c [ARO-26365, ARO-26372] Add CredScan suppressions for false positives
4e37dff Merge pull request #4955 from nikhil-thomas/ARO-26990/fix-mhc-isclusterupgrading
c404831 fix(machinehealthcheck): ARO-26990 eliminate IsClusterUpgrading false positive in MHC controller
c572354 scoping pod.conditions metrics emission (#4962)
2e696bd Merge pull request #4961 from Azure/tuxerrante/ARO-28189/ingress-visibility-fix
c3f470e Merge pull request #4935 from Azure/b-jieyuan/ARO-27840
c9e7dca Merge pull request #4964 from Azure/dependabot/go_modules/pkg/api/golang.org/x/crypto-0.52.0
54552f4 Merge pull request #4949 from Azure/admin-kubeconfig-endpoint
2ddacbc Detect worker VM quota/SKU errors from Machine ProviderStatus to enable E2E VM-size retry (#4936)
d948eed Admin API: JIT-elevated kubeconfig endpoints
bbe2a82 Merge pull request #4856 from Azure/feature/aro-27159-dynamic-memory-allocation
c98ed69 fix: improve defensive guards in compute_memory_budget
619a10c Merge pull request #4965 from Azure/dependabot/github_actions/step-security/harden-runner-2.20.0
7c8cd01 feat(deploy): add dynamic per-container memory allocation for RP VMSS
22beb9d chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0
c0ce7b3 chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /pkg/api
0c58748 fix(clusterdata): preserve stored ingress visibility on read
894d61a refactor(go): use any in put or patch helpers
ae91f7e fix(frontend): avoid persisting enrichment-only patch mutations
5292542 fix(clusterdata): stop inferring public ingress visibility
010d810 update message
d090b1c add master node protection policy for VAP
70e1c62 [ARO-26376] Replace InsecureIgnoreHostKey with persistent TOFU for portal SSH

Full Changelog: v20260714.00-test-muo-image...v20260722.00-lb-tagged-ip-dual-frontend