Add iso session test bundle for os vpack

[bbonaby]

📖 Description

The isolation session team needs to be able to run mxc from both main and their feature branch in windows nightly test passes to confirm their new features/refactors don't break MXC. They also want to test out experimental features for the iso session backend that may not be on Windows insider builds yet to confirm functionality with MXC before they check into main. These additions are done via their feature/isolation_session_feature-internal branch in the MXC repo. This PR adds the azure templates needed to package up wxc-exec, iso session configs and scripts from both main branch and the feature branch so they can be packaged into our Vpack.

🔗 References

🔍 Validation

Confirmed both new templates run successfully (main template)1ES.IsolationSession.TestBundle.yml, (fragment) IsolationSession.TestBundle.Build.Job.yml. Via: https://microsoft.visualstudio.com/Dart/_build/results?buildId=152983092&view=results

Vpack validation will happen after this is checked in.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See docs/pull-requests.md.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See docs/pull-requests.md
for the steps.

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Adds Azure Pipelines support for building IsolationSession test bundles from main and feature branches and staging them in the OS VPack.

Changes:

• Builds x64 IsolationSession binaries and test collateral.
• Publishes separate main and feature artifacts.
• Downloads, stages, and signs both bundles for VPack packaging.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
.azure-pipelines/1ES.IsolationSession.TestBundle.yml	Defines the dual-branch bundle pipeline.
.azure-pipelines/templates/IsolationSession.TestBundle.Build.Job.yml	Builds and assembles each test bundle.
.azure-pipelines/templates/Vpack.Package.Job.yml	Adds bundle download, staging, and signing.

Comments suppressed due to low confidence (1)

.azure-pipelines/templates/IsolationSession.TestBundle.Build.Job.yml:144

• Copying the entire dist directory makes the bundled run-tests.js execute every integration test. On Windows, package.test.js requires seven SDK binaries, but this bundle stages only wxc-exec.exe, so the provided runner is guaranteed to fail before it can serve as an IsolationSession test bundle. Stage only the IsolationSession test files and their helpers, or include the full expected binary set.

      # Built test files, runner, and package.json
      Copy-Item -Recurse "$integSrc/dist" "$sdkInteg/dist"
      Copy-Item "$integSrc/package.json" "$sdkInteg/package.json"
      Copy-Item "$integSrc/run-tests.js" "$sdkInteg/run-tests.js"

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (2)

.azure-pipelines/templates/IsolationSession.TestBundle.Build.Job.yml:171

• Build.SourceVersion identifies the pipeline's self repository/version, not the repository resource selected by checkoutRepo. In particular, the feature artifact will record the pipeline/main SHA instead of the commit that produced its binary, making the provenance manifest inaccurate. Read HEAD from the checked-out source tree instead.

          commit_sha     = "$(Build.SourceVersion)"

.azure-pipelines/templates/IsolationSession.TestBundle.Build.Job.yml:125

• This script cannot run from the published bundle: run_test_configs.ps1 requires wxc-test-driver.exe and runs a general configs directory, but assembly copies only wxc-exec.exe plus the IsolationSession config subset. Either omit this general runner or stage wxc-test-driver.exe and the config layout it expects.

          'run_test_configs.ps1'