[Simon Gallagher (vinfnet)]

Summary

Add two customer-facing examples explicitly bound to a confidential DC4 workload profile in UAE North:

• HTML hello world with ARM infrastructure, PowerShell deployment, and fail-closed placement/endpoint verification.
• Native Azure Functions (kind: functionapp) with Node.js 24 and GET /api/hello JSON output.
• Fresh ACR builds, immutable image deployment, managed identity, and private Blob host-storage networking with VNet-linked DNS.
• Customer READMEs covering deployment, portal/API access, host-storage health, costs, cleanup, and explicit DC4 placement verification.
• Portal cross-checks and a clear distinction between Azure-reported placement and independent cryptographic attestation.
• Root/sample navigation updates and removal of the unused App Services placeholder.

Validation

• 25 offline PowerShell tests passed.
• 10 Node.js 24 regression tests passed.
• 52 documentation links/anchors checked and 21 PowerShell examples parsed.
• git diff --check passed.
• Both examples deployed and verified on UAE North DC4; latest readback confirmed active, healthy revisions with one replica and explicit confidential-profile binding.
• Functions returned the expected HTTP 200 JSON, rejected POST, and acquired its Blob host-storage lease after private networking was configured.

Operational notes

Resources remain billable until explicitly cleaned up; this PR does not delete deployed resources. Endpoints are public and anonymous. Local .azure deployment records and .vscode settings are excluded.