refactor: reduce complexity of execute_impl in create_pull_request.rs

[github-actions]

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection results could not be parsed.

Review the workflow run logs for details.

What was complex

CreatePrResult::execute_impl in src/safe_outputs/create_pull_request.rs had ballooned to 583 lines (clippy too_many_lines, limit 100), mixing repository resolution, patch validation/security checks, git worktree setup, ADO base-commit resolution, and branch-collision retry logic all inline in one function.

What changed

Extracted five cohesive, independently-testable blocks into helper functions (no public API or behavior changes):

1. resolve_target_repository — validates self.repository against the allowed repository list and resolves it to an ADO repository ID.
2. load_and_validate_patch — reads the patch file, enforces the size limit, verifies SHA-256 integrity, and runs the excluded/protected-files and max-files security checks.
3. create_target_worktree — verifies the git repository and creates a worktree at the target branch (with origin/<branch> fallback), returning a WorktreeGuard for cleanup.
4. resolve_base_commit — resolves the push base commit, preferring the Stage-1-recorded SHA and falling back to the ADO refs API.
5. resolve_unique_source_branch — checks for source-branch name collisions on ADO and retries with a new random suffix (up to 3 times).

Before / after

• Before: 583/100 lines (clippy too_many_lines)
• After: 362/100 lines

Verification

• cargo build — clean
• cargo clippy --all-targets --all-features — clean, no warnings
• cargo test — full suite passes (2891+ tests, including all 58 create_pull_request unit/integration tests)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• spsprodeus21.vssps.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "spsprodeus21.vssps.visualstudio.com"

See Network Configuration for more information.

Generated by Cyclomatic Complexity Reducer · auto · 134.5 AIC · ⊞ 11.1K · ◷

[github-actions]

Threat detection produced a warning for this pull request output.

These changes need to be scrutinized before merge and only merged after a careful manual review.

• Detection reason: parse_error
• Review workflow run logs: https://github.com/githubnext/ado-aw/actions/runs/31581038019

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.