Summary

Verify pipeline integrity failed for agents using tools.azure-devops whenever checkout: listed additional repositories. The step had no workingDirectory, so it ran from $(Build.SourcesDirectory) — which has no .git in a multi-repo layout — and ado-aw check's internal recompile couldn't infer the ADO org from the git remote:

Error: Agent 'Capture the flag (CTF) agent' has tools.azure-devops enabled but no
ADO organization could be determined. Either set tools.azure-devops.org explicitly,
or compile from within a git repository with an Azure DevOps remote URL.

Changes:

• generate_integrity_check — set workingDirectory: {{ trigger_repo_directory }} on the step so the recompile runs from the trigger repo (which has .git).
• generate_pipeline_path — drop the {{ trigger_repo_directory }}/ prefix; the path is now relative and resolves against the new workingDirectory.
• generate_source_path — unchanged. The Stage 3 executor sets its own workingDirectory: {{ working_directory }}, which can point at an alias subfolder, so the source path must stay anchored at {{ trigger_repo_directory }}.
• Tests and AGENTS.md docs for {{ pipeline_path }} / {{ integrity_check }} updated.

Resulting step (multi-repo case):

- bash: |
    AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
    chmod +x "$AGENTIC_PIPELINES_PATH"
    $AGENTIC_PIPELINES_PATH check "ctf.yml"
  workingDirectory: $(Build.SourcesDirectory)/$(Build.Repository.Name)
  displayName: "Verify pipeline integrity"

Test plan

• Updated unit tests for generate_pipeline_path (relative output) and generate_integrity_check (asserts workingDirectory is set).
• cargo build, cargo test (914+ tests), cargo clippy --all-targets --all-features all pass.
• Manually compiled fixtures with and without checkout: and confirmed the emitted step uses $(Build.SourcesDirectory) and $(Build.SourcesDirectory)/$(Build.Repository.Name) respectively.