Add Azure DevOps validation canaries

[TacoRocket]

Summary

• add tracked Azure DevOps canary templates plus a sync helper for root YAML, template-follow, and named-target proof
• extend the lab manifest and validator to assert the configured-org DevOps canary expectations
• document the minimal DevOps prerequisites and add focused sync/validator tests

Verification

• python3 -m py_compile scripts/validate_azurefox_lab.py scripts/sync_devops_canaries.py
• python3 -m unittest tests/test_validate_azurefox_lab.py tests/test_sync_devops_canaries.py
• tofu validate
• python3 scripts/validate_azurefox_lab.py --mode commands-only --viewpoint all --skip-command role-trusts