refactor(compile): reduce complexity of build_pipeline_context in agentic_pipeline.rs

[github-actions]

What was complex

build_pipeline_context in src/compile/agentic_pipeline.rs was flagged by cargo clippy -W clippy::too_many_lines at 258/100 lines — the highest of any function in the crate. It mixed several independent concerns inline: front-matter validation, extension declaration collection, engine invocation/env/install-steps computation, and extension declaration fan-out into Agent job steps/conditions.

What changed

Extracted four cohesive blocks into named helper functions, each with a doc comment noting it exists purely to reduce cognitive complexity:

• validate_pipeline_front_matter — the sequence of shared front-matter validators (identity, permissions, timeout, variable groups, safe-outputs keys, threat detection, require-approval, staged, GitHub issue outputs, comment target, work-item target, PR review events/votes, PR thread statuses, ado-aw-debug config, supply-chain).
• collect_extension_declarations — the per-extension Declarations collection loop, including warning surfacing.
• fanout_extension_declarations — fan-out of collected Declarations into Agent setup steps, prepare steps, and conditions (plus prompt-supplement raw-YAML steps).
• build_engine_setup — engine invocation, install-steps, composed env block, and Copilot BYOM/BYOK exclusion-key computation for both the Agent and Detection engines (returns a small EngineSetup struct).

Before / after

• Before: too_many_lines (258/100)
• After: too_many_lines (192/100)

build_pipeline_context is still above the lint's threshold; the remaining body (network/MCPG config generation and paths/tokens/prompt content assembly) is a natural next target for a follow-up refactor.

Verification

• No public API or observable behavior changes — no signatures changed, only internal decomposition.
• Full test suite: cargo test — 2948 passed, 0 failed.
• cargo clippy --all-targets --all-features — clean, no warnings.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• spsprodeus21.vssps.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "spsprodeus21.vssps.visualstudio.com"

See Network Configuration for more information.

Generated by Cyclomatic Complexity Reducer · auto · 133.3 AIC · ⌖ 12.7 AIC · ⊞ 11.1K · ◷

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.