[agent-issue]: Fix Azure DevOps MCP repositories domain and pin package version

[krubenok]

Submission requirements

• I generated this issue with an agent that used .github/agents/ado-aw.agent.md.
• I reviewed the generated issue and confirm it is being filed directly in githubnext/ado-aw.

Problem summary

ado-aw v0.45.1 compiles tools.azure-devops.toolsets: [repos] into an Azure DevOps MCP launch argument of -d repos and invokes the unversioned package @azure-devops/mcp.

The current Azure DevOps MCP package uses the domain name repositories, not repos. The invalid domain logs an error and falls back to enabling every domain. In a hosted AWF run, MCPG initialized the Azure DevOps route but Copilot received no Azure DevOps tool definitions; the required repo_list_pull_request_threads tool was reported unavailable.

This also makes otherwise deterministic ado-aw lock files depend on whatever @azure-devops/mcp version is latest when the pipeline runs.

Reproduction details

Environment:

• ado-aw v0.45.1
• Copilot CLI 1.0.72-1
• MCPG v0.4.1
• @azure-devops/mcp resolved at runtime to 2.8.1

Workflow front matter:

tools:
  azure-devops:
    org: example
    toolsets:
      - repos
    allowed:
      - repo_list_pull_request_threads

Generated MCP command:

npx -y @azure-devops/mcp example -d repos -a envvar

Azure DevOps MCP 2.8.1 reports:

Specified invalid domain 'repos'. Please specify exactly as available domains:
advanced-security, pipelines, core, repositories, search, test-plans, wiki,
work, work-items

Its documented/current command is:

npx -y @azure-devops/mcp@2.8.1 example -d repositories -a envvar

Direct MCP and MCPG probes confirm repo_list_pull_request_threads is exposed when using the current package. The hosted generated pipeline instead initialized the azure-devops MCP server with zero Azure DevOps tool definitions visible to Copilot.

Proposed next step

• Map ado-aw's front-matter repos toolset identifier to the Azure DevOps MCP repositories domain at compilation.
• Pin @azure-devops/mcp to a tested version in generated pipelines and expose that pin in the ado-aw version catalog.
• Add an integration test that starts the pinned server through MCPG and asserts every configured allowed tool appears in tools/list before the Agent starts.
• Fail MCPG startup when the configured allowed-tool set resolves to zero tools instead of allowing a later incomplete Agent run.