Add validation for AGIC subnet configuration

CHANGELOG.md

@@ -52,6 +52,7 @@ Monitor the release status by regions at [AKS-Release-Tracker](https://releases.
 * AKS now allows migration from the `managedNATGatewayV2` outbound type to the `block` and `none` outbound types, supporting [network-isolated cluster](https://learn.microsoft.com/azure/aks/concepts-network-isolated) scenarios. Migration to other outbound types remains blocked.
 * AKS now validates pod CIDR ranges during cluster create and update for kubenet and [Azure CNI Overlay](https://learn.microsoft.com/azure/aks/azure-cni-overlay) clusters. Clusters can no longer be created or updated with a pod CIDR that overlaps with reserved IP ranges (`172.30.0.0/16`, `172.31.0.0/16`), preventing potential in-cluster networking failures. Existing clusters with an overlapping pod CIDR are unaffected. See [CNI prerequisites](https://learn.microsoft.com/azure/aks/concepts-network-cni-overview#prerequisites).
 * AKS now rejects [Calico NPM and Azure NPM](https://learn.microsoft.com/azure/aks/use-network-policies) install and uninstall operations on clusters running Kubernetes versions earlier than 1.30. Requests are rejected at the API level with a descriptive error directing customers to upgrade to a newer supported Kubernetes version before retrying. Existing clusters already using Calico NPM or Azure NPM are unaffected.
+* AKS now blocks the [Ingress Application Gateway (AGIC)](https://learn.microsoft.com/azure/application-gateway/ingress-controller-overview) add-on from using the AKS-managed `aks-appgateway` subnet. This subnet is reserved for Application Gateway for Containers (AGC) and can't be used by AGIC due to subnet delegation constraints. Requests using this configuration now fail validation. Use a dedicated subnet with `--appgw-subnet-id` or `--appgw-subnet-cidr`.
 
 #### Bug fixes