Add management SDK breaking-change attribution

[Yuchao Yan (msyyc)]

Summary

Extend the read-only management SDK PR-review agentic workflow to attribute newly added or modified ### Breaking Changes entries to TypeSpec/API changes, emitter/toolchain changes, both, or insufficient evidence.

The deterministic collector now:

• compares CHANGELOG entries at the PR merge base and pinned head while preserving the existing first-commit versus latest-commit API-version drift check
• preserves release headings, multiline entry text, line locations, and added/modified status while excluding unchanged history
• infers the previous SDK release tag and records when that baseline differs from the merge-base package state
• captures _metadata.json, tsp-location.yaml, API metadata, package configuration, and resolved dependency-lock evidence at immutable revisions
• distinguishes dependency ranges from resolved versions and surfaces missing, conflicting, truncated, malformed, or inaccessible evidence
• validates repository/SHA references and bounds pagination, response sizes, request count, and network timeouts

The reviewer prompt traces each entry through immutable specification and tooling evidence and adds a separate non-blocking ### Breaking-change attribution table to the existing single summary comment.

Security

• The workflow remains read-only and does not check out, execute, import, build, or regenerate PR-controlled code.
• The collector is fetched and executed only from the immutable trusted base SHA.
• PR, specification, and tooling content is treated as untrusted evidence rather than instructions.
• Existing review exclusions and the one-comment/hide-older-comments behavior are preserved.

Validation

• gh aw compile mgmt-sdk-pr-review --action-mode action --action-tag v0.80.9 --validate
• python .github/workflows/tests/test_mgmt_sdk_review_context.py (12 tests)
• Representative collection against [AutoPR azure-mgmt-deviceregistry]-generated-from-SDK Generation - Python-6811153 #48959 verified six introduced entries, release baseline azure-mgmt-deviceregistry_1.2.0b1, old specification SHA 5038b362fae5e6f54bb6fe7e0a0d18370a946acf, and ^0.37.1 as a range rather than a resolved version.

Limitations

• Attribution remains Unverified unless immutable evidence explains causation; specification or emitter version changes alone are not treated as proof.
• Previous-release selection is inferred from the newest non-placeholder CHANGELOG release heading and matching SDK tag because CHANGELOG generation does not record its exact comparison target.
• The workflow does not perform controlled old/new specification by old/new toolchain regeneration.
• Source/tooling investigation limits are enforced by reviewer instructions; deterministic API collection limits are enforced in code.

Exercise

After this draft is deployed to the default branch, add the mgmt-review-needed label to a management SDK PR such as #48959. The self-updating review comment should retain the findings and unverified-check sections and add one attribution row for each introduced breaking-change entry.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
10 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.