Do not use armCommonDefinition for customer managed keys (#4627)

## Summary

Hides the \CustomerManagedKeyEncryption\, \KeyEncryptionKeyIdentity\,
and \KeyEncryptionKeyIdentityType\ common types by marking them
\internal\ in the TypeSpec language, preventing direct use in service
specifications outside the \Azure.ResourceManager\ namespace.

Adds public replacement types in \Azure.ResourceManager.Foundations\:
- \CustomerManagedKeyEncryptionV4\
- \KeyEncryptionKeyIdentityV4\  
- \KeyEncryptionKeyIdentityTypeV4\

The \Encryption\ wrapper type remains public and continues to work as
before.

### Usage

\\\	sp
@armProviderNamespace
@service
namespace Microsoft.Contoso;

model EncryptionConfig {
customerManagedKey?:
Azure.ResourceManager.Foundations.CustomerManagedKeyEncryptionV4;
}
\\\

### Testing
- 5 new tests verifying the V4 types work and the internal types are
inaccessible from outside
- All 329 existing ARM package tests pass
- Docs regenerated (internal types no longer appear in reference docs)

Related to #4532 (alternative approach using \internal\ keyword instead
of decorator + linter rule)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: markcowl

.chronus/changes/hide-cmk-internal-2026-6-12-17-1-0.md

@@ -0,0 +1,14 @@
+---
+changeKind: feature
+packages:
+  - "@azure-tools/typespec-azure-resource-manager"
+---
+
+Remove `@armCommonDefinition` decorators from `CustomerManagedKeyEncryption` and `Encryption` types so they are emitted inline rather than as common-types `$ref` entries in OpenAPI output.
+
+```tsp
+// These types are now emitted inline in specs that reference them:
+model MyEncryptionConfig {
+  customerManagedKeyEncryption?: Azure.ResourceManager.CommonTypes.CustomerManagedKeyEncryption;
+}
+```

packages/samples/test/output/azure/resource-manager/resource-common-properties/encryption/@azure-tools/typespec-autorest/2023-03-01-preview/openapi.json

@@ -367,6 +367,116 @@
     }
   },
   "definitions": {
+    "Azure.Core.uuid": {
+      "type": "string",
+      "format": "uuid",
+      "description": "Universally Unique Identifier"
+    },
+    "Azure.ResourceManager.CommonTypes.CustomerManagedKeyEncryption": {
+      "type": "object",
+      "description": "Customer-managed key encryption properties for the resource.",
+      "properties": {
+        "keyEncryptionKeyIdentity": {
+          "$ref": "#/definitions/Azure.ResourceManager.CommonTypes.KeyEncryptionKeyIdentity",
+          "description": "All identity configuration for Customer-managed key settings defining which identity should be used to auth to Key Vault."
+        },
+        "keyEncryptionKeyUrl": {
+          "type": "string",
+          "description": "key encryption key Url, versioned or non-versioned. Ex: https://contosovault.vault.azure.net/keys/contosokek/562a4bb76b524a1493a6afe8e536ee78 or https://contosovault.vault.azure.net/keys/contosokek."
+        }
+      }
+    },
+    "Azure.ResourceManager.CommonTypes.Encryption": {
+      "type": "object",
+      "description": "(Optional) Discouraged to include in resource definition. Only needed where it is possible to disable platform (AKA infrastructure) encryption. Azure SQL TDE is an example of this. Values are enabled and disabled.",
+      "properties": {
+        "infrastructureEncryption": {
+          "$ref": "#/definitions/Azure.ResourceManager.CommonTypes.InfrastructureEncryption",
+          "description": "Values are enabled and disabled."
+        },
+        "customerManagedKeyEncryption": {
+          "$ref": "#/definitions/Azure.ResourceManager.CommonTypes.CustomerManagedKeyEncryption",
+          "description": "All Customer-managed key encryption properties for the resource."
+        }
+      }
+    },
+    "Azure.ResourceManager.CommonTypes.InfrastructureEncryption": {
+      "type": "string",
+      "description": "(Optional) Discouraged to include in resource definition. Only needed where it is possible to disable platform (AKA infrastructure) encryption. Azure SQL TDE is an example of this. Values are enabled and disabled.",
+      "enum": [
+        "enabled",
+        "disabled"
+      ],
+      "x-ms-enum": {
+        "name": "InfrastructureEncryption",
+        "modelAsString": true,
+        "values": [
+          {
+            "name": "Enabled",
+            "value": "enabled",
+            "description": "Encryption is enabled"
+          },
+          {
+            "name": "Disabled",
+            "value": "disabled",
+            "description": "Encryption is disabled"
+          }
+        ]
+      }
+    },
+    "Azure.ResourceManager.CommonTypes.KeyEncryptionKeyIdentity": {
+      "type": "object",
+      "description": "All identity configuration for Customer-managed key settings defining which identity should be used to auth to Key Vault.",
+      "properties": {
+        "identityType": {
+          "$ref": "#/definitions/Azure.ResourceManager.CommonTypes.KeyEncryptionKeyIdentityType",
+          "description": "The type of identity to use. Values can be systemAssignedIdentity, userAssignedIdentity, or delegatedResourceIdentity."
+        },
+        "userAssignedIdentityResourceId": {
+          "type": "string",
+          "format": "arm-id",
+          "description": "User assigned identity to use for accessing key encryption key Url. Ex: /subscriptions/fa5fc227-a624-475e-b696-cdd604c735bc/resourceGroups/<resource group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myId. Mutually exclusive with identityType systemAssignedIdentity."
+        },
+        "federatedClientId": {
+          "$ref": "#/definitions/Azure.Core.uuid",
+          "description": "application client identity to use for accessing key encryption key Url in a different tenant. Ex: f83c6b1b-4d34-47e4-bb34-9d83df58b540"
+        },
+        "delegatedIdentityClientId": {
+          "$ref": "#/definitions/Azure.Core.uuid",
+          "description": "delegated identity to use for accessing key encryption key Url. Ex: /subscriptions/fa5fc227-a624-475e-b696-cdd604c735bc/resourceGroups/<resource group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myId. Mutually exclusive with identityType systemAssignedIdentity and userAssignedIdentity - internal use only."
+        }
+      }
+    },
+    "Azure.ResourceManager.CommonTypes.KeyEncryptionKeyIdentityType": {
+      "type": "string",
+      "description": "The type of identity to use.",
+      "enum": [
+        "systemAssignedIdentity",
+        "userAssignedIdentity",
+        "delegatedResourceIdentity"
+      ],
+      "x-ms-enum": {
+        "name": "KeyEncryptionKeyIdentityType",
+        "modelAsString": true,
+        "values": [
+          {
+            "name": "SystemAssignedIdentity",
+            "value": "systemAssignedIdentity",
+            "description": "System assigned identity"
+          },
+          {
+            "name": "UserAssignedIdentity",
+            "value": "userAssignedIdentity",
+            "description": "User assigned identity"
+          },
+          {
+            "name": "DelegatedResourceIdentity",
+            "value": "delegatedResourceIdentity",
+            "description": "Delegated identity"
+          }
+        ]
+      }
+    },
     "Azure.ResourceManager.ResourceProvisioningState": {
       "type": "string",
       "description": "The provisioning state of a resource type.",
@@ -452,7 +562,7 @@
           "readOnly": true
         },
         "encryption": {
-          "$ref": "../../../../../../../../../specs/resource-manager/common-types/v5/customermanagedkeys.json#/definitions/encryption",
+          "$ref": "#/definitions/Azure.ResourceManager.CommonTypes.Encryption",
           "description": "All encryption configuration for a resource."
         }
       },

packages/typespec-azure-resource-manager/lib/common-types/common-types.tsp

@@ -4,7 +4,7 @@ import "./types-ref.tsp";
 import "./managed-identity-ref.tsp";
 import "./managed-identity-with-delegation-ref.tsp";
 import "./private-links-ref.tsp";
-import "./customer-managed-keys-ref.tsp";
+import "./customer-managed-keys.tsp";
 import "./extended-location-ref.tsp";
 import "./internal.tsp";
 import "./commontypes.private.decorators.tsp";