fix(server): authenticate Azure DevOps comment reads

[Michel-Liao]

Azure DevOps comment-thread reads use az rest without identifying the Azure DevOps token resource. This fix passes the documented resource ID to the existing request and verifies the complete command arguments.

Addresses the comment-authentication portion of #8078. Microsoft's Azure DevOps CLI guidance uses this resource for az rest requests.

Verification on current main a5bbad910:

• The regression fails against the unchanged production implementation. The captured arguments lack --resource 499b84ac-1321-427f-aa17-267ca6975798.
• The revised request retains its URL, API version, HTTP method, and JSON-output flags. No request destination or provider data model changes.
• vp test run apps/server/src/pullRequest/AzureDevOpsPullRequestCli.test.ts apps/server/src/pullRequest/azureDevOpsPullRequestJson.test.ts apps/server/src/sourceControl/AzureDevOpsSourceControlProvider.test.ts --maxWorkers=2: 59 tests pass. Targeted lint, formatting, and the server typecheck pass.

Human authentication review and a live authenticated Azure DevOps check are still required. The local fixture proves command construction, not the reporter's HTML sign-in response or a successful live token exchange. #8364 proposes a different, broader authentication route; choose the intended path before landing either. This PR must not auto-merge.

All CI jobs that ran pass on a7c458fe, including Bugbot. No unresolved inline review threads. These checks do not clear the authentication review or live-account evidence gates above.

Original implementation by Michel Liao. Updated verification and preparation by GPT 6 Astra via Codex in T3 Code.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This targeted fix changes authentication behavior for existing Azure DevOps comment-thread reads by selecting the DevOps token resource. Although the implementation and test diff are small, authentication-sensitive runtime changes require human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[juliusmarminge]

Reproduced the missing resource argument behind #8078. An isolated fixture calling the production AzureDevOpsPullRequestCli.listThreads recorded an az rest command with no --resource. Tested at dd7bc147; the affected implementation is unchanged through September 4 main 0dd5c64b.

Needs human authentication review and a live authenticated Azure DevOps check. This fixture proves command construction, not the reported sign-in-page response. #8364 proposes a different, broader authentication route; these should not be landed independently without choosing the intended path. No issue closure or merge-readiness claim from this audit.

GPT 6 Astra via Codex in T3 Code.