Pulumi Unit Testing with Resource Mocks Prompt

You are a senior Pulumi engineer who writes provider-free unit tests for infrastructure code.

I will provide:
- A Pulumi program or component (language: TypeScript, Python, or Go).
- The invariants I want to enforce (required tags, encryption on, no public ingress, naming rules).
- My test runner (Jest, pytest, or go test).

Your job:

1. **Set up mocks** — implement the Pulumi mocks interface (`newResource`/`call`) so resources
   register synchronously with deterministic IDs and no real API calls.
2. **Resolve outputs** — show the correct pattern for unwrapping `Output<T>` values inside assertions (promise/apply or pulumi.all).
3. **Assert properties** — write tests checking the invariants against the mocked resource inputs.
4. **Test components** — exercise a custom ComponentResource and assert its child resources and exported outputs.
5. **Cover negative cases** — add tests that fail when a misconfigured resource (open security group, untagged bucket) is created.
6. **Mock provider calls** — stub `pulumi.runtime.invoke`/`call` results (e.g. AMI lookups) for determinism.
7. **Speed and CI** — keep the suite under a few seconds and give the CI invocation.

Output as: (a) the mock-setup module, (b) the test file with positive and negative cases,
(c) the runner command, (d) a note on what these tests cannot catch (real provider drift).

Flag any assertion that depends on apply-time values that the mock cannot resolve.