test(marketplace): pin ADO sourceBase authoring->consume e2e + docs (#1010)

[danielmeppiel]

TL;DR

Azure DevOps marketplace support (#1010) is already implemented and tested at HEAD via the maintainer-approved design: ADO sources ride marketplace.sourceBase (a https://dev.azure.com/{org}/{project}/_git base) rather than a new host field or a widened SOURCE_RE. This PR closes the one remaining gap -- a hermetic end-to-end "authoring -> consume" pin -- and promotes ADO to a first-class, documented marketplace host.

Problem (WHY)

The isolated pieces of ADO marketplace support were proven independently, but the full marketplace flow (author an ADO sourceBase marketplace through the build pipeline, then consume a dependency from the emitted marketplace.json) had no hermetic regression pin. The only ADO marketplace e2e (tests/integration/test_ado_e2e.py) is gated on ADO_APM_PAT and hits live Azure DevOps, so it does not run in normal CI and cannot guard the authoring path.

Approach (WHAT)

1. Add a hermetic e2e test (tests/integration/test_ado_marketplace_e2e.py, no ADO_APM_PAT, no network) that authors an ADO sourceBase marketplace through the full MarketplaceBuilder.build() pipeline and consumes a dependency from the output.
2. Document ADO as a first-class marketplace host alongside GitHub / GHE / GitLab in the producer guide, manifest-schema reference, and the apm-guide package-authoring skill.
3. CHANGELOG [Unreleased] entry.

Implementation (HOW)

The new test asserts the end-to-end contract:

• Authoring: build() on sourceBase: https://dev.azure.com/contoso/platform/_git + source: agent-skills emits a source: url plugin whose URL parses (via urllib.parse) to host dev.azure.com, path /contoso/platform/_git/agent-skills -- host-preserving, not rewritten to github.com.
• Consume: DependencyReference.parse(url) yields host == dev.azure.com, is_azure_devops() is True, repo_url == contoso/platform/agent-skills; AuthResolver.classify_host(...).kind == "ado".
• No cross-host token leak: with a recording AuthResolver, resolution targets only ("dev.azure.com", "contoso") -- github.com is never asked, so an ADO ADO_APM_PAT can never be offered to a GitHub remote.
• Sibling guard: classify_host("github.com").kind == "github".

All URL assertions use urllib.parse component comparison per tests/instructions (never substring).

What is already shipped at HEAD (evidence)

Capability	Evidence	Status
ADO 3-part sourceBase composes relative repo, host preserved	tests/unit/marketplace/test_marketplace_source_base.py::test_ado_shaped_source_base_composes_relative_repo	PASS
ADO HTTPS URL classifies as git kind, dev.azure.com host kept	tests/unit/marketplace/test_parser.py::test_https_ado_url_classified_as_git	PASS
Generic-git host-typed auth (ADO incl.) + clone-based fetch	src/apm_cli/marketplace/client.py (classify_host, _FETCHERS["git"])	shipped
ADO install-as-dependency e2e (install/deps/prune/compile/virtual)	tests/integration/test_ado_e2e.py (+ bearer/auth suites)	PASS (live, ADO_APM_PAT)
Consumer cross-host host-stripping fix	shipped via #1762 / #1763 (routed to #1519 / #1014)	out of scope here

Scope / deferrals

• Deferred to perf(marketplace): optional ADO REST metadata client (/_apis/git/repositories/) to avoid clone-based fetch #1808: the ADO REST metadata client (/_apis/git/repositories/) is a perf optimization, NOT required for marketplace authoring. The generic-git clone path is the supported fetch.

Validation evidence

• New test: 4 passed.
• Combined suite tests/integration/test_ado_marketplace_e2e.py tests/unit/marketplace/test_marketplace_source_base.py tests/unit/marketplace/test_parser.py tests/integration/test_ado_e2e.py tests/integration/test_marketplace_builder_hermetic.py: 110 passed, 9 skipped (the 9 are the live requires_ado_pat cases).
• Lint chain (CI mirror): ruff check clean, ruff format --check clean, pylint R0801 10.00/10, scripts/lint-auth-signals.sh clean.

How to test

uv run --extra dev pytest tests/integration/test_ado_marketplace_e2e.py -v

Closes #1010.

[Copilot]

Pull request overview

Adds a hermetic integration regression pin for Azure DevOps (ADO) marketplace authoring via marketplace.sourceBase, and updates the docs/guides + changelog to treat ADO as a first-class marketplace host.

Changes:

• Add tests/integration/test_ado_marketplace_e2e.py to exercise the full “author marketplace -> emit marketplace.json -> consume emitted URL” contract without network or ADO_APM_PAT.
• Update producer docs + manifest schema reference + apm-guide package-authoring skill to document ADO sourceBase (https://dev.azure.com/{org}/{project}/_git) behavior.
• Add a CHANGELOG.md [Unreleased] entry for the documentation + hermetic e2e coverage.

Show a summary per file

File	Description
tests/integration/test_ado_marketplace_e2e.py	New hermetic end-to-end test covering ADO sourceBase authoring, consumer parsing, and host-scoped auth routing.
packages/apm-guide/.apm/skills/apm-usage/package-authoring.md	Adds ADO sourceBase authoring guidance and example.
docs/src/content/docs/reference/manifest-schema.md	Extends sourceBase reference text to explicitly include Azure DevOps behavior and host preservation.
docs/src/content/docs/producer/publish-to-a-marketplace.md	Producer guide now includes ADO as a supported sourceBase target with auth pointer.
CHANGELOG.md	Adds an [Unreleased] “Added” entry documenting ADO marketplace authoring host support + new hermetic test.

Copilot's findings

• Files reviewed: 5/5 changed files
• Comments generated: 1