docs(examples): add Azure Pipelines Bedrock scan example

[mldangelo-oai]

Summary

Add an Azure Pipelines example for running Codex Security against an Azure Repos
Git repository from a centrally owned tooling repository. The example uses the
existing CLI and AWS Toolkit instead of adding runtime integration code.

Changes

• Add a manually triggered pipeline with full and committed-diff scan modes,
  pinned CLI/Node/Python versions, and Bedrock OIDC authentication through an AWS
  service connection.
• Export completed scans to SARIF and optionally publish to the scanned
  repository using explicit repository-resource metadata. Preserve severity
  policy failures while still publishing completed results; do not publish
  failed exports or incomplete scans.
• Retain selected reports outside the checkout without uploading raw scan state
  or authentication files.
• Document permissions, setup, trust boundaries, artifact retention, and the
  additional PR-aware checkout/build-validation policy needed for automatic PR
  checks. Link the example from the examples index and add focused regression
  tests for its shell behavior and failure conditions.

Testing

• 53 tests passed with isolated state: bun test --timeout 30000 --seed 12345 tests-ts/azure-pipelines-example.test.ts tests-ts/cli-export.test.ts tests-ts/sarif.test.ts tests-ts/mock-scan.test.ts from sdk/typescript.
• pnpm --dir sdk/typescript run types, build:ci, and format passed;
  explicit Prettier checks for the new YAML/Markdown/test files and
  git diff --check passed.
• ShellCheck passed for all four inline Bash scripts. Both publishing variants
  passed structural checks against Microsoft's Azure Pipelines schema after
  expanding the conditional step; the schema's outdated task catalog was
  excluded, with task names and inputs checked separately against current
  publisher metadata and documentation.
• Published CLI 0.1.27 smoke tests, using synthetic repositories and --mock,
  passed with Node 24.21.0 and Python 3.14.7: the full scan exited 0; the diff scan
  with a high-severity threshold exited 1; both exported SARIF 2.1.0 and retained
  the expected reports. No model calls or live cloud connections were used.
• The broader SDK suite was attempted, then stopped after existing publication
  tests encountered sandbox restrictions on process inspection and the default
  state database. It is not claimed as passing.

Risk and rollout

This is example/documentation/test-only; there are no public CLI or runtime
changes. Runs are manual and native Advanced Security publishing is opt-in.
Adopters must configure a trusted pipeline, an authorized target repository,
an OIDC service connection, an approved Bedrock model, and publishing permissions
where applicable. Live OIDC authentication, Bedrock access, and Azure SARIF
ingestion still require validation in a configured test environment.

The example does not enroll repositories or enable automatic PR validation.
Repository contents and model output remain untrusted, and report artifacts can
contain sensitive source excerpts and vulnerability details.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

Please review commit 475f10e, including scan failure handling, credential scoping, and cross-repository SARIF publishing.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T06:26:25.610883Z	475f10e	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 475f10ed0e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".