# - Uses `az account get-access-token` instead of client_credentials flow. # - Resource group + cluster name can be passed in directly; auto-discovery # from the latest 'lab-*' deployment is still ...