Add iso session test bundle for os vpack

[Branden Bonaby (bbonaby)]

📖 Description

The isolation session team needs to be able to run mxc from both main and their feature branch in windows nightly test passes to confirm their new features/refactors don't break MXC. They also want to test out experimental features for the iso session backend that may not be on Windows insider builds yet to confirm functionality with MXC before they check into main. These additions are done via their feature/isolation_session_feature-internal branch in the MXC repo. This PR adds the azure templates needed to package up wxc-exec, iso session configs and scripts from both main branch and the feature branch so they can be packaged into our Vpack.

🔗 References

🔍 Validation

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See docs/pull-requests.md.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See docs/pull-requests.md
for the steps.

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Adds Azure pipelines to build, sign, publish, and package IsolationSession test bundles from main and feature branches.

Changes:

• Builds x64 IsolationSession binaries and test collateral.
• Publishes signed main and feature artifacts.
• Stages both artifacts into the OS VPack.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
.azure-pipelines/templates/Vpack.Package.Job.yml	Downloads and stages both test bundles.
.azure-pipelines/templates/IsolationSession.TestBundle.Build.Job.yml	Builds, signs, and publishes each bundle.
.azure-pipelines/1ES.IsolationSession.TestBundle.yml	Defines the two-branch bundle pipeline.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.azure-pipelines/templates/IsolationSession.TestBundle.Build.Job.yml:187

• branch_name is populated with the repository resource alias (mxc_main or mxc_iso_session_feature), not the branch that produced the bundle. This makes the new provenance manifest inaccurate—for example, the feature artifact cannot identify feature/isolation-session-internal. Pass the configured branch/ref into this template and record that value here (or rename this field to repository_alias if the alias is what consumers need).

          produced_at    = (Get-Date).ToUniversalTime().ToString('o')

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

.azure-pipelines/templates/IsolationSession.TestBundle.Build.Job.yml:188

• checkoutRepo is the Azure repository alias (mxc_main or mxc_iso_session_feature), not the checked-out branch. The emitted branch_name therefore records incorrect provenance instead of main or feature/isolation-session-internal. Pass the configured branch/ref into this template separately (or rename this manifest field if the alias is what consumers need).

          branch_name    = "${{ parameters.checkoutRepo }}"

.azure-pipelines/templates/IsolationSession.TestBundle.Build.Job.yml:55

• This adds a third hard-coded official Rust toolchain pin, but .github/copilot-instructions.md:5 still tells maintainers to update only the two existing *.Build.Job.yml pins. The next toolchain bump can leave this test-bundle pipeline on an old compiler. Update that documented synchronization rule in this PR, or centralize the pin so all official jobs consume one value.

        version: 'ms-prod-1.93'