Preflight NRE on first-time Microsoft.Web/sites create when properties is absent or a whole-object runtime expression (union over module outputs)

**Bicep version**
`0.45.15` (seems doesn't matter in this case) — reproduces with raw ARM JSON, so the defect is in ARM preflight / the Microsoft.Web RP. Filed here because (a) the common way to hit it is Bicep's compilation of `properties: union(...)` into a single expression, (b) prior art for this exact error lives here (#8189, #8216), and (c) hopefully this repo's triage reaches the right people.

**Describe the bug**
**TL;DR:** `Microsoft.Web`'s preflight throws an unhandled `Object reference not set to an instance of an object` when validating the **create** of a `Microsoft.Web/sites` whose `properties` is absent at preflight time. That happens in two cases:

1. the site resource literally has no `properties`, or
2. — the case that really hits — the entire `properties` value compiles to a single ARM expression that can't be resolved until deploy time (e.g. `properties: union(...)` over module outputs), so preflight forwards the resource to the RP **without** properties.

Validating/deploying the identical payload against an **existing** site passes.

**To Reproduce**
```json
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Web/sites",
"apiVersion": "2025-03-01",
"name": "nre-repro-8189-minimal-x91",
"location": "[resourceGroup().location]",
"kind": "app,linux"
}
]
}
```

```
az deployment group validate -g --template-file repro.json
# => InvalidTemplateDeployment — 'Microsoft.Web/sites (2025-03-01)' reported preflight
# validation errors. Inner error: "Object reference not set to an instance of an object."
```

**Additional context**
## How real Bicep templates hit it

```bicep
var siteProperties = {
serverFarmId: sharedPlan.outputs.planId // any module output in here …
// …
}

resource site 'Microsoft.Web/sites@2025-03-01' = {
name: siteName
location: location
kind: 'app,linux'
// … makes the WHOLE properties one runtime expression → absent at preflight → NRE
properties: union(siteProperties, { siteConfig: firewallConfig })
}
```

Notably, when `properties` stays a JSON object and only individual **fields** are runtime expressions, preflight passes — so plain-JSON authors mostly dodge this, while the common Bicep `union()` pattern walks straight into it. That likely explains why the 2022 reports in this thread looked "random": whether `properties` survives to preflight depends on template shape, not on the values.

## Evidence this is a platform-side regression (rolled out per region)

- A **byte-identical** compiled template with equivalent parameters **succeeded** in eastus2 on 2026-09-08 21:51 UTC and **failed** on 2026-09-09 18:41 UTC.
- centralus started failing around 2026-09-07.
- As of 2026-09-10 it reproduces in eastus2, centralus, westus2, northcentralus, westeurope.
- API-version independent: 2024-04-01 and 2025-03-01 behave identically.
- Create-only: the same templates validate fine once the site exists.

## Workarounds

1. Make the site's `properties` evaluable at preflight: pass module outputs across a module boundary as **parameters** and build `properties` from those params (params are resolved before the nested deployment is submitted). This fixed it for us with no behavior change.
2. Or keep `properties` a literal object with at most field-level runtime expressions — avoid `union()`/whole-object expressions on `Microsoft.Web/sites`.
3. Or pre-create the web app once; subsequent deployments (updates) don't hit the bug.

The issue provides no Bicep repository file, test, or entry point to modify. Start with the shown repro.json and run the az deployment group validate command against a resource group; done would require Microsoft.Web preflight validation to stop raising the NRE for a create with absent properties.

Written by the indexing model from the issue text.