[LoopedBard3]

Summary

• Select Service Bus worker authentication in docker/servicebus-controller/run.sh using SERVICE_BUS_MI_CLIENT_ID: unset or empty preserves certificate authentication; a nonempty client-ID GUID selects that user-assigned managed identity without certificate fallback.
• Override the image's certificate entrypoint only for managed identity, explicitly pass the identity into Docker, and omit the Service Bus certificate mount. Preserve Docker-option forwarding and the image's default entrypoint.
• Keep SQL certificate configuration and its mount for existing queued commands. SQL authentication remains independently selected by each queued command.
• Validate required settings and certificate files without printing their values, remove shell tracing, and document both launch modes.
• Add dependency-free offline tests that capture generated Docker arguments without starting containers or contacting Azure.

Validation

• Bash syntax checks passed for the launcher and test script.
• Offline Docker-stub checks passed for certificate defaults, identity selection, mixed Service Bus MI/SQL certificate configuration, invalid input, quoting, Docker-option placement, and failure propagation.
• The unreadable-file check was skipped on Windows because effective read access remained after changing the fixture's mode.
• No live Azure authentication or container integration tests were performed.