docs+ci: close out wave 1 — matrix entries, README rows, changelog

[naxty]

Problem

The 25 resource types from #126, #127 and #128 are on main with no ongoing test coverage and no documentation.

• 0 of 20 wave-1 fixtures were in .github/conformance-matrix.txt, so neither push-to-main nor nightly exercised any of them. Their PR runs proved them once; nothing guarded them afterwards.
• The README resource table listed 148 rows against 173 registered types.

Matrix — 113 → 128 active entries

Adds the 15 fixtures that passed CRUD and discovery on their own PR, which is the bar this file already asks for:

static-site · virtual-wan · vpn-site · bastion-host · all 11 cosmos-*

Ten stay out, each with its reason recorded inline:

Fixture(s)	Why
app-service-plan, web-app, function-app, web-app-slot	Subscription has a dedicated-VM quota of 0, and an App Service plan of any sku runs on dedicated VMs — verified against both B1 (Basic) and F1 (Free), refused identically
app-service-certificate, custom-hostname-binding	Need a real verified custom domain (Azure serves an ownership challenge CI cannot answer)
virtual-hub	Passes locally end to end (68m50s), but its CRUD phase measures ~59 min — longer than the OIDC client assertion stays valid, so the run dies on AADSTS700024 in the final phase
vpn-gateway, virtual-network-gateway, virtual-network-gateway-connection	60–90 min lifecycles, past the job's timeout-minutes: 120

Note virtual-hub is not a plugin bug — VirtualHub.Delete waits for the hub router correctly (ARM refuses DeleteVirtualHub while routingState is Provisioning, ~11 min past the create LRO reporting Succeeded). It's a credential-lifetime limit. Re-add once CI can refresh auth mid-phase.

Also: virtual-hub added to conformance-pr-skip.txt

It was excluded from the matrix but not from PR scope, so the next PR touching its fixture would have spent an hour to fail on the same expired assertion. Verified matrix and skip list have zero overlap (the two files are asserted disjoint by conformance-scope.sh).

README — 148 → 173 rows

Derived the gap from the schemas rather than by hand, so it catches anything I'd have missed. Added the 25 missing rows and re-sorted; the table and the registered types now agree exactly, and there are no stale rows.

Verification

registered: 173 | listed: 173 | missing: none
table sorted correctly: True

matrix: 128 | skip: 10 | overlap: none
duplicates: none
wrongly active (excluded fixtures): none

conformance-scope self-check: 13 passed, 0 failed
REUSE: compliant

Not in this PR

Two blockers that need people, not code:

• Raise the subscription's App Service / regional vCPU quota → unblocks 4 Web fixtures
• Let CI refresh Azure auth mid-phase → unblocks virtual-hub and any future >45-minute fixture

Both are recorded in the matrix comments with the exact removal condition.