refactor: reduce complexity of execute_impl in update_work_item.rs

[github-actions]

What was complex

execute_impl in src/safeoutputs/update_work_item.rs was a 245-line function with ~25 control-flow points. It mixed five distinct concerns inline:

1. Resolving ADO context and config
2. Validating the target constraint
3. Validating which fields are permitted by the config (7 sequential if guards)
4. Fetching the work item and checking title-prefix / tag-prefix guards
5. Building the JSON Patch document and sending the PATCH request

What changed

Four focused helpers were extracted:

Helper	Responsibility
check_target_config(id, config)	Returns None (allowed) or Some(failure) based on the configured target pattern/ID
check_field_permissions(params, config)	Data-driven table of (message, field_set, field_enabled) tuples — replaces 7 sequential if guards
check_prefix_guards(client, ..., config)	Fetches the work item once (if either prefix guard is set) and verifies title-prefix and tag-prefix rules
build_patch_document(params, config)	Assembles the Vec<serde_json::Value> JSON Patch operations

execute_impl is now ~100 lines of linear orchestration that reads top-to-bottom without deep nesting.

Before / after complexity

• Before: 245 lines, ~25 control-flow points, 3+ levels of nesting in the prefix-guard block
• After: ~100-line execute_impl + 4 single-responsibility helpers, max 2 levels of nesting

Verification

• cargo build ✅
• cargo test ✅ (all tests pass)
• cargo clippy --all-targets --all-features ✅ (no new warnings in the changed file)
• No changes to public API signatures or observable behaviour

Generated by Cyclomatic Complexity Reducer · ● 1.2M · ◷