Replace CI scan curl access

[vitek-karas]

Motivation

This replaces direct HTTP reads in the CI failure scan with one repository-owned helper. It also creates a clear place to later redirect CI evidence inputs for deterministic evals, without changing the commands the scan uses.

Changes

• Add ci-evidence-reader with fixed commands for Azure DevOps and Helix evidence.
• Update ci-failure-scan to install and use the helper instead of curl.
• Keep build definition IDs open while retaining the fixed build query shape and paging limits.
• Use a table to define the direct request commands and add focused tests for the command routing.

Validation

• py -3 .github\workflows\tests\test_ci_evidence_reader.py (20 tests)
• gh-aw v0.86.2 compile ci-failure-scan --strict --validate

Note

This pull request description was created by GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[jkoritzinsky]

Can the Helix reads use the hlx MCP server?

[vitek-karas]

Probably - but it would require quite a bit of changes to the agent, since the MCP tools are different shape/process than what the agent does today. I would also need to test it if it will work without auth, technically it should, but I didn't try to deploy it into actions.
Finally it makes the "mocking" for deterministic evals a bit more difficult/complex.

Using the MCP would likely mean less new code, but it would also mean a bigger change to the agent itself. I would not combine the two changes even though they're related.

[lewing]

hlx only requires auth when it is required by the endpoint. I don't need to block the work here but I'm happy to build in features to support evals and add url filtering to hlx, lets chat about what would be useful.