refactor(compile): unify AzureCLI@2 token-mint steps behind a shared typed helper #1378

Summary

There are now multiple near-identical AzureCLI@2 token-mint steps in the compiler that all follow the same contract (az account get-access-token … --query accessToken -o tsv → ##vso[task.setvariable variable=…;issecret=true]) but are built two different ways:

• common::generate_acquire_ado_token (src/compile/common.rs) — the ADO read/write tokens (SC_READ_TOKEN / SC_WRITE_TOKEN, from permissions.read/write). Built as a hand-assembled raw YAML string, with manual service-connection quoting (sc.replace('\'', "''")).
• provider_token_mint_step (src/compile/agentic_pipeline.rs) — the BYOK provider bearer token (AW_PROVIDER_BEARER_TOKEN), added in feat(engine): add engine.provider (BYOK) with in-job Azure CLI token minting #1377. Built with the typed AzureCli builder + a validated ProviderResourceUrl / ServiceConnection newtype, set -eo pipefail, and single-quoted resource.

The two read consistently at the contract level but diverge in implementation. The provider step follows the newer target patterns (typed IR builders, secure.rs newtypes); generate_acquire_ado_token is the older raw-YAML approach.

Proposal

Extract a single shared typed helper, e.g.:

fn acquire_azure_token_step(service_connection: &str, resource: &str, out_var: &str /*, opts */) -> TaskStep

and migrate both the ADO read/write token paths and the provider path onto it. Benefits: one place for the mint idiom, typed construction everywhere, serde-handled escaping (drop the manual replace('\'', "''")), and consistent set -eo pipefail.

Notes / open questions

• addSpnToEnvironment: true — set by generate_acquire_ado_token, not by provider_token_mint_step. It is not required for az account get-access-token (the AzureCLI@2 task already authenticates az from the service connection; neither script consumes $servicePrincipalId/Key). The shared helper should default it off; confirm nothing relies on the ADO path exporting SPN env vars before removing it.
• set -eo pipefail — the shared helper should include it (the ADO path currently lacks it).
• Resource typing — the ADO path uses a constant ADO_RESOURCE_ID; the provider path uses a user-supplied, validated ProviderResourceUrl. The helper should accept an already-shell-safe resource string.
• Blast radius — generate_acquire_ado_token feeds SC_READ_TOKEN / SC_WRITE_TOKEN consumption across all four targets (standalone / 1es / job / stage) and interacts with apply_bundle_auth / token_source_for (SC_WRITE_TOKEN). This is why it was intentionally left out of feat(engine): add engine.provider (BYOK) with in-job Azure CLI token minting #1377 (the [aw]: Follow-up to #1261: $(Setup.*) in engine.env compiles but never resolves at runtime (Foundry BYOM → managed-identity 403) #1372 fix) and split into this follow-up. Verify emitted lock YAML is byte-stable for the ADO paths after migration.

Follow-up to #1377 / #1372.