refactor(engine): emit typed install steps instead of YAML strings

[Copilot]

Summary

Replace rendered engine-install YAML with typed IR steps.

• Emit Copilot install and version checks as BashStep.
• Emit 1ES organization resolution, NuGet authentication, and installation as typed Bash/task steps.
• Pass Vec<Step> directly into Agent and Detection jobs, removing indentation and RawYaml round-tripping.
• Expose generated install steps to IR graph and summary inspection.
• Preserve standalone, 1ES, job, and stage output behavior.

Test plan

• Engine install unit tests
• Inspect/graph integration tests
• Standalone, 1ES, job, and stage compilation tests
• Bash lint fixture suite

• Fixes refactor(engine): emit typed install steps instead of YAML strings #1834

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

✅ PR Security Reviewer completed the security review.

[github-actions]

⚠️ Rust Code Quality Reviewer failed during the Rust code quality review.

[github-actions]

✅ Compiler Contract Reviewer completed the compiler contract review.

[github-actions]

✅ Test Quality Sentinel completed the test quality analysis.

[github-actions]

Security review: no regressions found. This PR is a pure refactor replacing hand-built YAML strings for engine install steps with typed IR steps (BashStep, NuGetAuthenticate, NuGetCommand). All values embedded (base_url, display_name, version, ado_org) are the same compiler-controlled/previously-existing inputs as before — none are newly derived from untrusted front matter. Using typed steps instead of raw string YAML construction is a hardening improvement (removes a manual YAML-escaping surface), not a weakening. No token/scope changes, no new network domains, no validation removed.

🔒 Security review by PR Security Reviewer · auto · 28.4 AIC · ⌖ 2.52 AIC · ⊞ 11.3K
_{Comment /review to run again}

[github-actions]

Reviewed as the compiler-contract guardian. This is a clean typed-IR refactor: Engine::install_steps now returns Vec<Step> instead of a YAML string, Step::RawYaml's doc comment in step.rs was updated to drop the now-inaccurate "engine install_steps" reference, and docs/ir.md's existing RawYaml guidance ("reserved for user-authored setup/teardown YAML... not for compiler-generated steps") already covers this direction — no doc update needed there. Tests were adapted to assert against typed BashStep/TaskStep fields instead of substring matching on YAML, and tests/inspect_integration.rs gained assertions that the new steps surface in the IR summary. No codegen, lock-file, or ado-script bundle drift applies to this change. No raw String identifier fields were introduced. No contract-half is missing.

🏗️ Compiler contract review by Compiler Contract Reviewer · auto · 27.3 AIC · ⌖ 2.99 AIC · ⊞ 11.9K
_{Comment /review to run again}

[github-actions]

Overall the test updates correctly adapt to the new Vec<Step> return type and the bash_step/task_step helpers are a nice DX improvement. Found one place where an assertion was narrowed in a way that reduces its regression-catching power (inline comment). The rest of the diff (new RawYaml-absence assertions, inspect_integration.rs additions checking install steps surface in the IR summary) looks like a faithful behavior-preserving conversion.

🧪 Test quality analysis by Test Quality Sentinel · auto · 42.3 AIC · ⌖ 3.35 AIC · ⊞ 10.9K
_{Comment /review to run again}

[github-actions]

This assertion is narrowed from checking the whole rendered YAML for "msazuresphere" to checking only the NuGetCommand@2 arguments field, so a leaked org name in any other step (e.g. NuGetAuthenticate@1, the "Add copilot to PATH" bash script, or a future step) would no longer be caught.

💡 suggestion

Since result is now Vec<Step>, iterate all steps' textual content (script/inputs) instead of just the one arguments field, e.g.:

assert!(
    result.iter().all(|step| match step {
        Step::Bash(b) => !b.script.contains("msazuresphere"),
        Step::Task(t) => !t.inputs.values().any(|v| v.contains("msazuresphere")),
        _ => true,
    })
);

This preserves the original test's intent (no leakage of the default org anywhere in the emitted steps) rather than just one field.