[Hou (SciencePotato)]

Summary

• add a Phase 1 Azure DevOps YAML pipeline for CYOT validation, packaging, and optional FC1 development deployment
• build JavaScript, .NET, and Python packages once and verify archive contents and SHA-256 digests before deployment
• deploy one selected runtime per approved run to avoid a mixed three-runtime release
• protect deployment with fixed ADO resources, manual opt-in, main guard, environment and service-connection checks, federated ARM connection, and strict Azure preflight
• validate the exact three-app inventory, runtime, FC1 deployment storage, host settings, setup tags, region, endpoint application, and Easy Auth policy
• deploy through Azure CLI One Deploy, synchronize triggers with bounded retries, and require the runtime-specific CYOT function to register
• leave authenticated encrypted evaluation and alerting to the approved external SAS Synthetics implementation

Validation

• JavaScript: 143 passed
• .NET 10: 245 passed
• Python: 188 passed
• Windows setup regression scripts passed
• Azure Pipelines YAML and all eight embedded PowerShell blocks parsed successfully
• package, identity, strict target shape, FC1 storage/runtime, Easy Auth, AzureCloud, function-registration, and privacy guards validated

Phase 1 limits

This PR does not register or execute an Azure Pipeline, perform a real FC1 deployment, support EP1 package deployment, or change external synthetic-monitoring configuration. It does not yet add an SBOM, signed provenance, organization scanners, infrastructure deployment, Bicep what-if, automatic rollback, or a blocking SAS evaluation check. EP1 requires a separate design that preserves the guided setup managed-identity private-package model. An anonymous 401 and function registration do not prove application readiness; readiness requires a successful deployment-correlated SAS Synthetics mode: 2 evaluation.