agent: plumb ANC hotfix version from toggle to cloud-init

Add server-side support for delivering aks-node-controller hotfix
version to nodes via cloud-init write_files:

- Add GetANCHotfixVersion() to Toggles interface + default impl
- Add ANCHotfixVersion field to NodeBootstrappingConfiguration
- Resolve toggle BEFORE template rendering in GetNodeBootstrapping
- Add GetANCHotfixVersion template function in baker.go
- Add conditional write_files entry in nodecustomdata.yml that writes
  /opt/azure/containers/aks-node-controller-hotfix.json when set
- Update test mock to satisfy new interface method

The hotfix JSON file is consumed by ANC selfUpdate() (PR #8257)
which reads it at startup to determine if a PMC package upgrade is
needed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Devinwong

pkg/agent/bakerapi_test.go

@@ -1,7 +1,11 @@
 package agent
 
 import (
+	"bytes"
+	"compress/gzip"
 	"context"
+	"encoding/base64"
+	"io"
 
 	"github.com/Azure/agentbaker/pkg/agent/datamodel"
 	agenttoggles "github.com/Azure/agentbaker/pkg/agent/toggles"
@@ -276,6 +280,49 @@ var _ = Describe("AgentBaker API implementation tests", func() {
 			_, err = agentBaker.GetNodeBootstrapping(context.Background(), config)
 			Expect(err).NotTo(HaveOccurred())
 		})
+
+		It("should include ANC hotfix config file in customData when toggle is set", func() {
+			toggles := &testToggles{
+				ancHotfixVersion: "0.1.2",
+			}
+			agentBaker, err := NewAgentBaker()
+			Expect(err).NotTo(HaveOccurred())
+			agentBaker = agentBaker.WithToggles(toggles)
+
+			nodeBootStrapping, err := agentBaker.GetNodeBootstrapping(context.Background(), config)
+			Expect(err).NotTo(HaveOccurred())
+
+			customData := decodeCustomData(nodeBootStrapping.CustomData)
+			Expect(customData).To(ContainSubstring("/opt/azure/containers/aks-node-controller-hotfix.json"))
+			Expect(customData).To(ContainSubstring(`{"version":"0.1.2"}`))
+		})
+
+		It("should NOT include ANC hotfix config file in customData when toggle is empty", func() {
+			agentBaker, err := NewAgentBaker()
+			Expect(err).NotTo(HaveOccurred())
+
+			nodeBootStrapping, err := agentBaker.GetNodeBootstrapping(context.Background(), config)
+			Expect(err).NotTo(HaveOccurred())
+
+			customData := decodeCustomData(nodeBootStrapping.CustomData)
+			Expect(customData).NotTo(ContainSubstring("aks-node-controller-hotfix.json"))
+		})
+
+		It("should NOT include ANC hotfix config file for Windows nodes", func() {
+			config.AgentPoolProfile.Distro = datamodel.CustomizedWindowsOSImage
+			toggles := &testToggles{
+				ancHotfixVersion: "0.1.2",
+			}
+			agentBaker, err := NewAgentBaker()
+			Expect(err).NotTo(HaveOccurred())
+			agentBaker = agentBaker.WithToggles(toggles)
+
+			nodeBootStrapping, err := agentBaker.GetNodeBootstrapping(context.Background(), config)
+			Expect(err).NotTo(HaveOccurred())
+
+			// Windows custom data won't contain cloud-init write_files
+			Expect(nodeBootStrapping.CustomData).NotTo(ContainSubstring("aks-node-controller-hotfix"))
+		})
 	})
 
 	Context("GetLatestSigImageConfig", func() {
@@ -506,3 +553,18 @@ var _ = Describe("AgentBaker API implementation tests", func() {
 
 	})
 })
+
+// decodeCustomData decodes the base64+gzip encoded customData string back to the raw cloud-init YAML.
+func decodeCustomData(encoded string) string {
+	decoded, err := base64.StdEncoding.DecodeString(encoded)
+	Expect(err).NotTo(HaveOccurred())
+	reader, err := gzip.NewReader(bytes.NewReader(decoded))
+	if err != nil {
+		// not gzipped, return as-is (e.g. Windows)
+		return string(decoded)
+	}
+	defer reader.Close()
+	data, err := io.ReadAll(reader)
+	Expect(err).NotTo(HaveOccurred())
+	return string(data)
+}