Add DevDiv API and static analysis pipelines - #26288

Summary

• add build/azure-pipelines/devdiv/python-extension-api.yml for the @vscode/python-extension package
• preserve Linux, macOS, and Windows verification on Node 22.21.1; latest/next; publication disabled by default; API Scan; TSA; secure ESRP npm publication; DevDiv feed publication; and release/pythonExtensionApi/ GitHub releases/tags
• add build/azure-pipelines/devdiv/static-analysis.yml as the source-controlled replacement for classic definition 13577
• preserve Bandit, PoliCheck, AntiMalware, CredScan, AutoApplicability, vulnerability assessment, report/log publication, TSA, and component detection while correcting Bandit from pythonFiles to python_files and making AntiMalware scan the source tree

Design notes

The API pipeline follows the proven DevDiv MicroBuild/1ES npm pattern. API Scan and TSA remain explicit jobs/tasks to avoid duplicate 1ES injection. The Monaco symbol feed was removed; API Scan uses SymWeb and the extracted package only. The existing API pipeline TSA notification alias monacotools@microsoft.com is retained because there is no verified Python team alias in the repository; the owning team should confirm a replacement before cutover.

The static pipeline is YAML because DevDiv reports that new classic pipelines are disabled for the project/organization. Its sdl block explicitly disables auto-injected Bandit, AntiMalware, component governance, CredScan, ESLint, PoliCheck, report/log, and TSA tasks so only the parity-preserving legacy tasks run. Static TSA retains 13577's kanadig@microsoft.com notification alias pending an approved Python-team alias. It adds service tree ID 6e6194bc-7baa-4486-86d0-9f5419626d46, which is already used by the vscode-python extension pipelines; 13577 left this value empty. Definition 13577 is not modified or disabled.

Validation

• both YAML files parse locally
• git diff --check passes
• 46 GitHub checks passed. Tests (ubuntu-latest, 3.x, venv) failed twice before tests because the existing workflow had a null CONDA environment variable at Join-Path -Path $Env:CONDA; this is unrelated to the two YAML-only changes. The external vscode-engineering run completed successfully even though GitHub's aggregate check remains stale/pending.
• DevDiv has the exact static-analysis task aliases and major versions referenced by the YAML
• all selected pools and the Pylance_PublicPackages feed exist in DevDiv
• live definition creation is blocked: Access denied. Stella Huang needs Create build pipeline permissions for path \Python\VSCode Python Extensions\vscode-python in team project DevDiv to perform the action. The same denial occurs at \Python
• Azure YAML preview through existing definition 27973 is also blocked: User not permitted to queue dry run for build pipeline 27973 with modified YAML. Permissions needed: EditBuild.
• API Scan additionally requires a DevDiv service connection named vscode-apiscan and a secret APIScanConnectionString pipeline variable; neither is currently visible to the caller

An admin can unblock validation by granting Create build pipeline on \Python\VSCode Python Extensions\vscode-python, or by granting EditBuild on a validation definition for yamlOverride. After that:

1. Create both definitions against refs/pull/26288/merge with GitHub connection fb1b4583-c76e-4376-b5a0-294d56ae7d09.
2. Run the API definition with quality=latest publishPythonApi=false runAPIScan=false to validate build, tests, and package creation before API Scan credentials are provisioned.
3. Configure and authorize vscode-apiscan plus the secret APIScanConnectionString, then rerun with quality=latest publishPythonApi=false runAPIScan=true.
4. Run the static-analysis definition manually.

The pipeline guard prevents publication when API Scan is disabled. Existing definitions 635 and 13577 must remain untouched until both replacements succeed.

Tracking: https://github.com/microsoft/pyrx/issues/10073