[codex] Add GitHub release asset pipeline mode

[favoyang]

Summary

Adds a githubRelease package source mode for Azure package publishing. In this mode the queue provides an exact release asset URL/name and the pipeline downloads that tarball directly instead of cloning and packing the repository.

Changes

• Add packageSource, packageAssetUrl, and packageAssetName pipeline parameters.
• Keep existing git source behavior as the default.
• Download GitHub release assets unauthenticated in Azure and emit parseable download-not-found/download-failed errors.
• Validate downloaded .tgz / .tar.gz package artifacts before publish, including archive shape and package.json name/version.
• Add GitHub Actions e2e coverage for both git and GitHub release asset modes.

Validation

• Azure e2e workflow passed for the branch, including the new GitHub release asset fixture.
• Local pipeline script tests were run during implementation for the new tarball metadata validation coverage.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e575b7f7ab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Skip Azure E2E when PAT secret is missing

Failing the workflow when AZURE_DEVOPS_TOKEN_OPENUPM_PIPELINE is unset will break pull_request runs that do not receive repository secrets (for example, fork PRs or bot-originated PRs), causing CI to fail even when code changes are valid. This is a regression from the previous behavior that explicitly skipped Azure E2E without failing, and it conflicts with the documented expectation that the Azure E2E job runs only when that secret is available.

Useful? React with 👍 / 👎.