Add DevOps YAML-backed pipeline evidence

[TacoRocket]

Summary

• add YAML-backed Azure DevOps pipeline evidence for repo-backed definitions and same-repo templates
• keep DevOps auth and parse failures truthful while admitting real Azure clues from YAML variable groups and service connections
• cover the new behavior with focused DevOps and deployment-path regressions

Verification

• python3 -m ruff check src/azurefox/collectors/provider.py tests/test_collectors.py tests/test_errors.py tests/test_cli_smoke.py
• PYTHONPATH=src python3 -m pytest -q tests/test_collectors.py::test_devops_pipeline_summary_surfaces_partial_read_refs tests/test_collectors.py::test_devops_pipeline_summary_extracts_non_repo_trusted_inputs tests/test_collectors.py::test_devops_pipeline_summary_extracts_structured_app_service_target_clue tests/test_collectors.py::test_devops_pipeline_summary_extracts_structured_aks_and_arm_target_clues tests/test_collectors.py::test_devops_pipeline_summary_tracks_cross_project_template_repo tests/test_collectors.py::test_devops_cross_project_artifact_producer_control_flows_into_deploy_pipeline
• PYTHONPATH=src git push -u origin devops-yaml-pipeline-evidence --force-with-lease