Phase 1: inject managed Recipe secrets through container connections

[willdavsmith]

Summary

Phase 1 updates the Kubernetes Bicep and Terraform Container Recipes so one producer connection can inject both ordinary connection values and Recipe-managed secret references.

• Projects ordinary top-level scalar metadata and nested connection.properties values as CONNECTION_<CONNECTION>_<PROPERTY>.
• Projects producer-managed connection.secrets.<key>.source and .key metadata through Kubernetes valueFrom.secretKeyRef.
• Preserves direct connections to user-authored Radius.Security/secrets resources. These now generate fully uppercased names such as CONNECTION_CREDENTIALS_APIKEY; this intentional compatibility change replaces the prior envFrom behavior that preserved data-key casing.
• Applies the same behavior to regular and init containers.
• Preserves explicit environment-variable precedence, disableDefaultEnvVars, managed-secret-over-ordinary precedence, and uppercase collision validation for secret-derived names.
• Leaves the Azure ACI Recipe unchanged.

Dependency and scope

Producer-managed output references depend on radius-project/radius#12709 supplying resolved metadata at:

• context.resource.connections.<connection>.secrets.<key>.source
• context.resource.connections.<connection>.secrets.<key>.key

Direct user-authored Secret connections do not depend on #12709 and retain independent live CI coverage through the existing authored connection source and resolved Secret data.

This PR intentionally excludes Phase 2 catalog adoption and coordinated live producer-output verification. READMEs, schemas, and test apps for AI/models, AI/search, Data/mongoDatabases, Data/redisCaches, Messaging/kafka, Messaging/rabbitMQ, Storage/objectStorage, and docs/using-resource-types.md remain at the base contract. End-to-end managed-output verification belongs in Phase 2/resource-types-verification once a Radius build containing #12709 is available; this PR does not conditionally skip that assertion or turn a missing dependency into success.

Validation

• Bundled Bicep compilation for the Kubernetes Container Recipe
• Terraform formatting, initialization, and validation
• Synthetic Terraform plan assertions for top-level and nested ordinary values, managed references, direct Secrets, explicit precedence, managed-over-ordinary precedence, disabled malformed references, ordinary uppercase collisions, and regular/init parity
• Negative Terraform plan for secret-name uppercase collisions
• Bicep extension generation for retained Container and Secret schemas
• Bicep compilation for the Container test app
• Live Bicep and Terraform CI assertions for direct Secret projection, explicit precedence, disabled connections, and regular/init parity
• Shell syntax and targeted ShellCheck for the recipe test script
• YAML parsing, Markdown baseline comparison, and git diff --check

The earlier failed Bicep and Terraform jobs both deployed Redis successfully and then failed only at the coordinated CONNECTION_REDIS_URL assertion because the workflow control plane does not yet expose connection.secrets. That assertion and its Redis adoption fixture were removed from Phase 1 rather than conditionally skipped; all unrelated recipe deployments in those jobs passed.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None