ci(hosted-agents): add Azure Pipelines cloud E2E

[Antriksh Jain (antriksh30)]

Summary

Moves the Hosted Agents Azure Pipelines cloud E2E definition and its complete dependency closure into the public source-of-truth repository.

This PR migrates only the ADO pipeline. It does not copy the retained, disabled GitHub cloud-E2E workflows.

Included

• .azure-pipelines/hosted-agents-samples-ci.yml
• internal/tools/samples-hosted-agents-ci/**
• Hosted Agent contract/test-spec fixtures required by discovery
• internal/tools/voicelive-e2e/voicelive_audio_smoke_test.py
• Public CODEOWNERS routing for all migrated paths

Behavior

• Keeps the ADO-native discovery, sharded matrix, deploy, invoke, assertion, cleanup, summary, and artifact behavior.
• Remains self-contained; it does not execute scripts from the disabled GitHub cloud-E2E workflow.
• Contains no private-repository literal or secret.
• Private sync-gate status publication and the foundry-samples-validation-bot-credentials dependency were removed before migration.

Validation

• Pipeline YAML parses.
• All 39 inline Bash blocks pass bash -n.
• All four ADO support test suites pass:
  • session quota helpers
  • toolbox lifecycle
  • fixture mapping
  • test-spec parsing/planning
• Every repository path referenced by the pipeline exists in this PR.
• Executable bits match the private source.

Post-merge ADO setup

1. Rebind or clone pipeline 57497 (Foundry Samples Hosted Agents CI) to microsoft-foundry/foundry-samples and this YAML path.
2. Authorize variable group samples-hosted-agents-ci.
3. Authorize service connection foundry-samples-pr-mumford.
4. Run sampleFilter=01-basic, then an unfiltered full matrix.

Fork note

Public policy intentionally makes the required trusted check fail for fork PRs. A repository maintainer will need to promote/recreate this head as a same-repository branch before merge.