Add throwaway canary feed OIDC probe workflow

Phase 0 probe validating id-cpd-ci OIDC federated credential can mint an Azure DevOps token and publish to the internal copilot-canary-spike npm feed. To be deleted once Phase 0 is proven.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: MackinnonBuck

.github/workflows/canary-feed-oidc-probe.yml

@@ -0,0 +1,70 @@
+name: canary-feed-oidc-probe
+
+# THROWAWAY Phase 0 probe. Validates that id-cpd-ci (via the OIDC federated
+# credential on environment:cicd) can mint an Azure DevOps token and publish to
+# the internal copilot-canary-spike npm feed. Delete once Phase 0 is proven.
+
+on:
+  workflow_dispatch:
+
+permissions:
+  id-token: write   # for azure/login OIDC
+  contents: read    # for actions/checkout
+
+jobs:
+  probe:
+    runs-on: ubuntu-latest
+    environment: cicd   # MUST match federated credential subject repo:github/copilot-sdk:environment:cicd
+    steps:
+      - name: Azure Login (OIDC -> id-cpd-ci)
+        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
+        with:
+          client-id: "${{ vars.CPD_ID_CLIENT_ID }}" # id-cpd-ci
+          tenant-id: "${{ vars.CPD_ID_TENANT_ID }}"
+          subscription-id: "${{ vars.CPD_ID_SUBSCRIPTION_ID }}"
+
+      - name: Mint Azure DevOps token
+        id: adotoken
+        run: |
+          TOKEN=$(az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query accessToken -o tsv)
+          echo "::add-mask::$TOKEN"
+          echo "token=$TOKEN" >> "$GITHUB_OUTPUT"
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Publish throwaway package to spike feed
+        env:
+          FEED_TOKEN: ${{ steps.adotoken.outputs.token }}
+        run: |
+          set -euo pipefail
+          WORK="$(mktemp -d)"; cd "$WORK"
+          VERSION="0.0.0-ci.${{ github.run_number }}"
+          cat > package.json <<JSON
+          { "name": "@copilot-canary-spike/ci-probe", "version": "${VERSION}", "description": "OIDC CI round-trip probe" }
+          JSON
+          cat > .npmrc <<EOF
+          registry=https://pkgs.dev.azure.com/devdiv/DevDiv/_packaging/copilot-canary-spike/npm/registry/
+          //pkgs.dev.azure.com/devdiv/DevDiv/_packaging/copilot-canary-spike/npm/registry/:_authToken=${FEED_TOKEN}
+          //pkgs.dev.azure.com/devdiv/DevDiv/_packaging/copilot-canary-spike/npm/:_authToken=${FEED_TOKEN}
+          EOF
+          npm publish
+          echo "Published @copilot-canary-spike/ci-probe@${VERSION}"
+
+      - name: Read back (fresh install)
+        env:
+          FEED_TOKEN: ${{ steps.adotoken.outputs.token }}
+        run: |
+          set -euo pipefail
+          WORK="$(mktemp -d)"; cd "$WORK"
+          VERSION="0.0.0-ci.${{ github.run_number }}"
+          cat > .npmrc <<EOF
+          registry=https://pkgs.dev.azure.com/devdiv/DevDiv/_packaging/copilot-canary-spike/npm/registry/
+          //pkgs.dev.azure.com/devdiv/DevDiv/_packaging/copilot-canary-spike/npm/registry/:_authToken=${FEED_TOKEN}
+          //pkgs.dev.azure.com/devdiv/DevDiv/_packaging/copilot-canary-spike/npm/:_authToken=${FEED_TOKEN}
+          EOF
+          npm view "@copilot-canary-spike/ci-probe@${VERSION}" version
+          npm install "@copilot-canary-spike/ci-probe@${VERSION}" --no-save
+          test -f node_modules/@copilot-canary-spike/ci-probe/package.json && echo "READBACK OK"