chore: move release publishing to Azure pipelines

[Jane Chu (janechu)]

Pull Request

📖 Description

Moves release publishing off GitHub Actions and onto two Azure Pipelines under .ado/pipelines/ — azure-pipelines-build.yml (FAST CD Build) and azure-pipelines-cd.yml (FAST CD) — so release credentials never leave the Azure environment.

• FAST CD Build triggers on every push to main, detects publishable workspaces whose ${name}_v${version} tag doesn't yet exist on origin, and packs their npm tarballs and paired Rust crates into pipeline artifacts.
• FAST CD triggers automatically when FAST CD Build's BuildArtifacts stage completes, signs the artifacts, publishes to npm/crates.io via FAST.Release.PipelineTemplate, and only then creates the git tag and GitHub release per package — publishing before tagging means a publish failure never strands a tag, so the next FAST CD Build run automatically retries.
• Removes the nightly cd-github-releases.yml GitHub Actions workflow and the old create-github-releases.mjs / download-github-releases.mjs script pair, replacing them with pack-pending-releases.mjs, check-release-tags.mjs, read-release-manifest.mjs, and a shared publishable-workspaces.mjs helper.
• Updates check-publish-pipeline.mjs (the PR-validation guardrail that keeps Azure CD task coverage in sync with publishable workspaces), CONTRIBUTING.md, and .github/workflows/README.md to describe the new pipeline design.

👩‍💻 Reviewer Notes

• Required before this can run for real: both FAST CD Build and FAST CD need to be registered as pipelines in Azure DevOps and repointed at the new .ado/pipelines/azure-pipelines-build.yml / .ado/pipelines/azure-pipelines-cd.yml paths (and the old root-level azure-pipelines-cd.yml pipeline definition retired/repointed) before this change is effective. This is an operational/ADO-admin step outside of this repo's source and cannot be verified from GitHub tooling.
• Operational verification item: FAST.Sign.PipelineTemplate.yml and FAST.Release.PipelineTemplate.yml live in the internal open-source/FASTPipelineTemplates Azure DevOps repository, which is not accessible from GitHub tooling. Their exact parameter contracts (in particular how they handle an absent artifact directory) could not be independently verified while authoring this pipeline — please confirm against the live templates during ADO pipeline registration/rollout. The empty-directory removal step in the Publish job is a defense-in-depth measure taken because that contract could not be confirmed.
• Please review the publish-then-tag ordering rationale in .github/workflows/README.md (FAST CD section) — it's the key behavioral change from the prior design and affects retry/idempotency semantics.

📑 Test Plan

• node build/scripts/check-publish-pipeline.mjs — passes, verifies Azure CD coverage for all 4 publishable workspaces.
• node build/scripts/pack-pending-releases.mjs --check-only — passes, reports 0 pending releases against current tags.
• npm run checkchange — passes, no change file required (paths touched are all under beachball's ignored .github//tooling scope).
• node build/biome-changed.mjs check --staged — passes, checked 5 staged .mjs files, no fixes needed.
• Validated all three new/changed .ado/pipelines/*.yml files parse as valid YAML.
• node --check syntax validation on all new/modified .mjs scripts.

✅ Checklist

General

• I have included a change request file using $ npm run change
• I have added tests for my changes.
• I have tested my changes.
• I have updated the project documentation to reflect my changes.
• I have read the CONTRIBUTING documentation and followed the standards for this project.

Agents

• I have linked to an existing issue in this project that this change addresses
• I have read the skills
• I have read the DESIGN.md file(s) in packages relevant to my changes
• I have updated the DESIGN.md file(s) in packages relevant to my changes

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.