refactor(engine): emit typed install steps instead of YAML strings

[jamesadevine]

Context

This refactor is prompted by PR #1824 review threads:

• feat(ado-proxy): add credential-isolated Azure DevOps reads #1824 (comment)
• feat(ado-proxy): add credential-isolated Azure DevOps reads #1824 (comment) (reply to discussion_r3724479152)
• feat(ado-proxy): add credential-isolated Azure DevOps reads #1824 (comment)

copilot_install_steps currently returns rendered YAML strings, which forces resolve_ado_organization_bash(indent) and another format string. That conflicts with the IR rule that compiler-generated steps should use typed step representations (Step::Bash, BashStep, TaskStep) and that lowering should own YAML indentation.

This should be addressed across the engine and every target caller so compiler-generated install steps become typed Vec<Step> (or an equivalent typed representation), while genuinely user-authored YAML remains the only RawYaml escape hatch.

Requirements

• Refactor generated install steps so they are emitted as typed steps rather than rendered YAML strings.
• Make the organization resolver return an unindented script or a typed BashStep rather than a string that requires caller-side indentation logic.
• Remove the need for callers to pass indentation for generated install steps.
• Ensure 1ES organization resolution, NuGet auth, and install steps are typed.
• Preserve standalone/1ES/job/stage output behavior.
• Ensure the IR graph/summary can see the generated steps.
• Keep compile fixtures and bash lint passing.

Acceptance

• Organization resolution returns an unindented script or typed BashStep.
• No caller passes indentation for generated install steps.
• 1ES organization resolution/NuGet auth/install steps are typed.
• Standalone/1ES/job/stage output behavior is preserved.
• IR graph/summary sees the steps.
• Compile fixtures and bash lint pass.