refactor(compile): reduce complexity of build_safeoutputs_job in agentic_pipeline.rs

[github-actions]

What was complex

build_safeoutputs_job in src/compile/agentic_pipeline.rs was flagged by clippy::too_many_lines at 162/100 lines. It was a single monolithic function assembling all steps of the SafeOutputs job (checkout, write-token acquisition, compiler bootstrap, create-pull-request prepare steps, GitHub App token mint/revoke, executor invocation, log copy, artifact publish, and job condition wiring) inline, making it hard to read and test each concern in isolation.

What changed

Extracted seven well-named helper functions, each owning one logically distinct concern, with their original doc comments preserved and attached to the new function:

• push_safeoutputs_multi_checkout_steps — replicates the Agent job's multi-checkout layout for create-pull-request.
• push_safeoutputs_compiler_bootstrap_steps — downloads analyzed outputs, the compiler, adds it to PATH, prepares the output directory.
• push_safeoutputs_prepare_pr_base_steps — stages the ado-script bundle and emits prepare-pr-base steps for local/cross-org repos.
• safeoutputs_github_actor_required — whether the GitHub App actor login is needed for comment-on-github-issue.
• push_safeoutputs_github_app_token_step — mints the GitHub App installation token.
• push_safeoutputs_github_app_token_revoke_step — revokes it after the executor runs.

build_safeoutputs_job now reads as a short, linear sequence of calls to these helpers plus the job/pool/condition assembly.

No behavior change: the same steps are emitted in the same order under the same conditions — this is a pure extraction, not a logic change.

Before/after complexity

• Before: clippy::too_many_lines reported build_safeoutputs_job at 162/100 lines.
• After: build_safeoutputs_job no longer appears in the clippy::too_many_lines violation list for this file (confirmed via cargo clippy --all-targets --all-features --message-format=json -- -W clippy::too_many_lines).

Verification

• cargo build --bin ado-aw — succeeds.
• cargo test --bin ado-aw — all 3406 tests pass (0 failed), including the 79 tests in compile::agentic_pipeline.
• cargo clippy --all-targets --all-features — clean, no warnings.
• Only src/compile/agentic_pipeline.rs is touched; an incidental cargo fmt --all pass over unrelated files was reverted to keep this PR surgical.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• spsprodeus21.vssps.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "spsprodeus21.vssps.visualstudio.com"

See Network Configuration for more information.

Generated by Cyclomatic Complexity Reducer · auto · 106.1 AIC · ⌖ 15.7 AIC · ⊞ 11.1K · ◷

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.