az stack-whatif sub create returns DeploymentStackWhatIfOperationFailed RP 500 (East US 2)

## Summary

`az stack-whatif sub create` fails with `DeploymentStackWhatIfOperationFailed` / Resource Provider internal server error on a PAYG subscription in **East US 2**. The write is authorized (Owner and a GitHub Actions plan identity both get past `deploymentStacksWhatIfResults/write`). ARM then 500s after ~11–16s. No What-If result resource is created.

Classic `az deployment sub what-if` on the same subscription does **not** 500 (it returns a normal template error on a different Bicep file).

This is **not** the same as a missing-RBAC 403. A User Access Administrator without the What-If write action gets a real `AuthorizationFailed` on `Microsoft.Resources/deploymentStacksWhatIfResults/write`. Owner does not.

## Environment

- Azure CLI **2.89.1** (`az stack-whatif` from [azure-cli#32854](https://github.com/Azure/azure-cli/pull/32854))
- API version **2025-07-01** (only advertised version for `Microsoft.Resources/deploymentStacksWhatIfResults`)
- Subscription: `e6f724db-eeeb-4651-aa50-eaf84efc3bf1` (Azure subscription 1 / PAYG)
- Location: **eastus2**
- `Microsoft.Resources` is Registered
- Provider catalog lists `deploymentStacksWhatIfResults` in East US 2
- No deployment stack exists (`az stack sub list` is empty)
- `Microsoft.Resources/DeploymentStacksPreview` is NotRegistered (leftover from old stacks preview; not flipped)

## Repro (minimal)

`minimal.bicep`:

```bicep
targetScope = 'subscription'

resource rg 'Microsoft.Resources/resourceGroups@2024-03-01' = {
name: 'rg-barry-whatif-probe'
location: 'eastus2'
}
```

```bash
az stack-whatif sub create \
--name barry-minimal-probe \
--stack-id /subscriptions/e6f724db-eeeb-4651-aa50-eaf84efc3bf1/providers/Microsoft.Resources/deploymentStacks/nonprod-dev \
--retention-interval P1D \
--location eastus2 \
--template-file minimal.bicep \
--action-on-unmanage detachAll \
--deny-settings-mode none \
--only-show-errors \
--no-pretty-print \
--output json
```

Same 500 with `--retention-interval PT3H` and with `--validation-level ProviderNoRbac`. Unique result names still fail. `--stack-id` points at a stack that does not exist yet (documented as valid; see #243).

## Error

```json
{
"code": "DeploymentStackWhatIfOperationFailed",
"message": "Resource Provider has encountered an internal server error. Diagnostic information: timestamp '...', request ID '...', request correlation ID '...'."
}
```

Activity log for the plan identity: `Microsoft.Resources/deploymentStacksWhatIfResults/write` **Started** then **Failed** with the same RP 500 (not `AuthorizationFailed`). `az stack-whatif sub list` stays `[]`. Result GET is `ResourceNotFound`.

## Correlation IDs (UTC)

| When (UTC) | Who / variant | Request ID | Correlation ID |
|---|---|---|---|
| 2026-08-21 17:44:16Z | Owner, full stamp, default validation | `e38968d0-4cec-4688-a4b9-14200c9ab456` | `0c96e6f8-57cf-4799-be15-2b75b23de087` |
| 2026-08-21 17:44:41Z | Owner, full stamp, ProviderNoRbac | `7ff118ff-826d-4486-8722-9d3c7663237b` | `e8bc9e20-5f43-42d6-9db5-ca9e9df9736e` |
| 2026-08-21 17:45:39Z | Owner, minimal one-RG template, P1D | `03d77af9-1752-4d24-a91c-c586842915a0` | `c7e7e133-ec3c-4f3a-9c18-1da0a10eeb76` |
| 2026-08-21 18:01:49Z | Owner, PT3H retention check | `98024695-74ce-42f2-88fa-6293d9367a88` | `f50973d5-e8bd-425d-9ca6-13d712804c2f` |

GitHub Actions plan identity (OIDC, same sub, same command, after login succeeded) hits the same `DeploymentStackWhatIfOperationFailed` 500.

## What we already ruled out

- Missing `deploymentStacksWhatIfResults/write` (UAA 403 vs Owner/plan 500)
- Template complexity / a malformed VNet id in a larger stamp (minimal one-RG still 500s)
- `--validation-level ProviderNoRbac`
- Retention `P1D` vs `PT3H` (both 500; CLI accepts PT3H despite help text saying 1–30 days — see #250)
- Result name colliding with the stack name
- Resource type missing from East US 2 in the provider catalog
- Classic deployment What-If being broken on this sub (it is not)

Related: #163 (stack operations 500 when the real issue was permission/deny-settings). Here Owner with `--deny-settings-mode none` still 500s on a one-RG template, so it does not look like that specific miss.

Happy to try a group-scope What-If if useful; this subscription currently has no resource groups and we have not created one.

Please route to ARMDeploymentStacks if that is still the right inbox (#224).

Start with minimal.bicep and the documented az stack-whatif sub create command, then compare the Owner, UAA, validation-level, retention, and classic deployment What-If results described here. Done means reproducing the East US 2 500, confirming whether the failure is in the CLI or Resource Provider, and routing the evidence to ARMDeploymentStacks if appropriate.

Written by the indexing model from the issue text.