Safe output executor should match repository by name, not just resource alias

[jamesadevine]

Bug

The safe output executor rejects create-pull-request when the agent uses the actual Azure DevOps repository name (e.g. sdk-FtdiDeviceControl) instead of the pipeline resource alias (e.g. repo-sdk-ftdidevicecontrol).

Reproduction

Pipeline: OS+Tooling CG Purview
Build: 604679

The agent emitted a create-pull-request safe output with repository: sdk-FtdiDeviceControl. The executor rejected it:

Repository 'sdk-FtdiDeviceControl' not in allowed list: ["repo-4x4-releaseengineering", ..., "repo-sdk-ftdidevicecontrol", ...]

The repository is checked out (as repo-sdk-ftdidevicecontrol, which maps to 4x4/sdk-FtdiDeviceControl), so the PR should have been allowed.

Expected behavior

The safe output executor should resolve the repository field against the actual Azure DevOps repository name (e.g. sdk-FtdiDeviceControl). The repository name can contain the project.

Representative repositories item:

- repository: repo-sdk-devicecommunication
    type: git
    name: 4x4/sdk-DeviceCommunication

Actual behavior

Only the local checked out file path is accepted - it should be the repository name.