feat(workflows): add ado-task-ir-contributor agentic workflow

[Copilot]

Adds an agentic workflow that runs every 4 hours to incrementally expand typed IR coverage for Azure DevOps built-in tasks — one focused PR per run.

Summary

The IR has Step::Task(TaskStep) as a generic escape hatch, but typed factory functions exist for only a handful of tasks (UseNode@1, UseDotNet@2, etc.). Emitting any other ADO task requires hand-crafting TaskStep::new(...) with raw string inputs. Some compiler-generated Step::RawYaml usages could also be migrated to typed steps.

The new workflow:

• Schedule: runs every 4 hours (and on workflow_dispatch)
• Deduplication: checks cache-memory state + open ado-task-ir PRs before starting
• Coverage audit: greps for existing TaskStep factory functions and Step::RawYaml in non-user-YAML compiler paths
• Catalog fetch: crawls learn.microsoft.com/.../tasks/reference/ for the full built-in task list; falls back to grepping tests/fixtures
• Priority: Step::RawYaml conversions first → fixture tasks → catalog tasks
• Implementation: typed factory function (e.g. copy_files_step(src, contents, dst) -> TaskStep) with doc comment in src/compile/ir/tasks.rs or the appropriate runtime/extension module
• State: jq-based write to cache-memory to avoid manual JSON errors
• Gate: cargo build, cargo test, cargo clippy must all pass before opening a PR
• Permissions: pull-requests: read in the agent (Stage 1) is sufficient — the compiler automatically grants pull-requests: write to the SafeOutputs (Stage 3) job that creates the PR

Test plan

• gh aw compile ado-task-ir-contributor compiles cleanly with 0 errors and 0 warnings

[jamesadevine]

@copilot every 4 hour schedule

[Copilot]

@copilot every 4 hour schedule

Done — schedule changed to every 4h in 4b46448.

[jamesadevine]

@copilot Are the permissions correct here? Do we need to have pull request write?

[Copilot]

@copilot Are the permissions correct here? Do we need to have pull request write?

The permissions are correct. The front matter pull-requests: read applies only to the Agent (Stage 1) job, which only needs to read PRs (e.g. gh pr list deduplication check). The compiler automatically grants pull-requests: write to the SafeOutputs (Stage 3) job that actually executes the create-pull-request safe output — you can see this at line 980 of the compiled lock.yml.