[ci] Govern dnceng internal pipeline (#12530)

## Summary

- Migrate `dotnet-android-internal` to the official 1ES governed pipeline template while preserving its triggers, stage graph, pool images, signing flow, artifact names, and package-test JDK selection.
- Resolve repository-local templates explicitly from `@self` and classify auxiliary repositories for SDL scanning.
- Use the lightweight `dotnet/macios-devtools` repository wherever a second checkout exists only to keep the primary repository at `s/android`. This covers the internal, public, official/shared, and nightly pipelines; comments document why the checkout is required. Real MAUI integration jobs continue to check out `dotnet/maui`.
- Remove preinstalled .NET SDKs and runtimes from hosted macOS test agents before setup to prevent low-disk warnings without weakening the existing warning gate.

## Validation

- Azure DevOps template previews succeeded for the internal, public, official, PR, and nightly pipeline definitions.
- [Internal validation build 3060061](https://dev.azure.com/dnceng/internal/_build/results?buildId=3060061) ran commit `c33b84759`: 38 jobs passed and all hosted macOS jobs completed with zero low-disk warnings.
- The five failed jobs contain the same existing CheckLint test failures reproduced by the non-governed `main` build; no migration, checkout-shim, or disk-cleanup regression was found.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: jonathanpeppers

build-tools/automation/azure-pipelines-internal.yaml

@@ -15,10 +15,10 @@ resources:
     type: git
     name: DevDiv/Xamarin.yaml-templates
     ref: refs/heads/main
-  - repository: maui
+  - repository: macios-devtools
     type: github
-    name: dotnet/maui
-    ref: net11.0
+    name: dotnet/macios-devtools
+    ref: refs/heads/main
     endpoint: xamarin
 
 parameters:

build-tools/automation/azure-pipelines-nightly.yaml

@@ -33,6 +33,11 @@ parameters:
 # Repository resources
 resources:
   repositories:
+  - repository: macios-devtools
+    type: github
+    name: dotnet/macios-devtools
+    endpoint: public
+    ref: refs/heads/main
   - repository: maui
     type: github
     name: dotnet/maui
@@ -81,10 +86,11 @@ stages:
       submodules: recursive
       persistCredentials: false
 
-    # Checkout a second repo to force multi-repo checkout behavior
+    # This small repository is intentionally unused; its checkout keeps the
+    # primary repository at s/android under Azure's multi-repo layout.
     # https://learn.microsoft.com/en-us/azure/devops/pipelines/repos/multi-repo-checkout?view=azure-devops#checkout-path
-    - checkout: maui
-      path: s/maui
+    - checkout: macios-devtools
+      path: s/macios-devtools
 
     - template: /build-tools/automation/yaml-templates/build-macos-steps.yaml
       parameters:
@@ -141,9 +147,10 @@ stages:
       submodules: recursive
       persistCredentials: false
 
-    # Checkout a second repo to force multi-repo checkout behavior
-    - checkout: maui
-      path: s/maui
+    # This small repository is intentionally unused; its checkout keeps the
+    # primary repository at s/android under Azure's multi-repo layout.
+    - checkout: macios-devtools
+      path: s/macios-devtools
 
     - script: |
         sudo apt-get update

build-tools/automation/azure-pipelines-public.yaml

@@ -21,6 +21,11 @@ resources:
     type: git
     name: DevDiv/Xamarin.yaml-templates
     ref: refs/heads/main
+  - repository: macios-devtools
+    type: github
+    name: dotnet/macios-devtools
+    ref: refs/heads/main
+    endpoint: xamarin
   - repository: maui
     type: github
     name: dotnet/maui
@@ -75,6 +80,7 @@ extends:
       sourceRepositoriesToScan:
         exclude:
         - repository: yaml-templates
+        - repository: macios-devtools
         - repository: maui
       suppression:
         suppressionFile: $(Build.SourcesDirectory)\.gdn\.gdnsuppress

build-tools/automation/azure-pipelines.yaml

@@ -40,9 +40,10 @@ stages:
         resource: ${{ parameters.repositoryAlias }}
         commit: ${{ parameters.checkoutCommit }}
 
-    # Always checkout a second resource to ensure we are using multi-repo checkout behavior
+    # This small repository is intentionally unused; its checkout keeps the
+    # primary repository at s/android under Azure's multi-repo layout.
     #  https://learn.microsoft.com/en-us/azure/devops/pipelines/repos/multi-repo-checkout?view=azure-devops#checkout-path
-    - checkout: maui
+    - checkout: macios-devtools
 
     - template: /build-tools/automation/yaml-templates/build-linux-steps.yaml
       parameters:

build-tools/automation/yaml-templates/build-linux.yaml

@@ -73,9 +73,10 @@ stages:
         resource: ${{ parameters.repositoryAlias }}
         commit: ${{ parameters.checkoutCommit }}
 
-    # Always checkout a second resource to ensure we are using multi-repo checkout behavior
+    # This small repository is intentionally unused; its checkout keeps the
+    # primary repository at s/android under Azure's multi-repo layout.
     #  https://learn.microsoft.com/en-us/azure/devops/pipelines/repos/multi-repo-checkout?view=azure-devops#checkout-path
-    - checkout: maui
+    - checkout: macios-devtools
 
     - task: CodeQL3000Init@0
       displayName: CodeQL 3000 Init

build-tools/automation/yaml-templates/build-macos.yaml

@@ -22,9 +22,10 @@ steps:
   inputs:
     forceReinstallCredentialProvider: true
 
-# Always checkout a second resource to ensure we are using multi-repo checkout behavior
+# This small repository is intentionally unused; its checkout keeps the
+# primary repository at s/android under Azure's multi-repo layout.
 #  https://learn.microsoft.com/en-us/azure/devops/pipelines/repos/multi-repo-checkout?view=azure-devops#checkout-path
-- checkout: maui
+- checkout: macios-devtools
 
 - task: CodeQL3000Init@0
   displayName: CodeQL 3000 Init

build-tools/automation/yaml-templates/commercial-build.yaml

@@ -35,4 +35,4 @@ steps:
     installTestSlicer: ${{ parameters.installTestSlicer }}
     installApkDiff: ${{ parameters.installApkDiff }}
     androidSdkPlatforms: ${{ parameters.androidSdkPlatforms }}
-    use1ESTemplate: false
+    use1ESTemplate: ${{ parameters.use1ESTemplate }}

build-tools/automation/yaml-templates/setup-test-environment-public.yaml

@@ -2,6 +2,7 @@
 
 parameters:
   macTestAgentsUseCleanImages: 
+  usePublicSetupTemplate: false
   use1ESTemplate: true
 
 stages:
@@ -21,9 +22,16 @@ stages:
     workspace:
       clean: all
     steps:
-    - template: /build-tools/automation/yaml-templates/setup-test-environment.yaml
-      parameters:
-        use1ESTemplate: ${{ parameters.use1ESTemplate }}
+    - ${{ if eq(parameters.usePublicSetupTemplate, true) }}:
+      - template: /build-tools/automation/yaml-templates/setup-test-environment-public.yaml
+        parameters:
+          jdkMajorVersion: $(DefaultJavaSdkMajorVersion)
+          useAgentJdkPath: true
+          use1ESTemplate: ${{ parameters.use1ESTemplate }}
+    - ${{ else }}:
+      - template: /build-tools/automation/yaml-templates/setup-test-environment.yaml
+        parameters:
+          use1ESTemplate: ${{ parameters.use1ESTemplate }}
 
     - task: DownloadPipelineArtifact@2
       inputs:
@@ -108,9 +116,16 @@ stages:
     workspace:
       clean: all
     steps:
-    - template: /build-tools/automation/yaml-templates/setup-test-environment.yaml
-      parameters:
-        use1ESTemplate: ${{ parameters.use1ESTemplate }}
+    - ${{ if eq(parameters.usePublicSetupTemplate, true) }}:
+      - template: /build-tools/automation/yaml-templates/setup-test-environment-public.yaml
+        parameters:
+          jdkMajorVersion: $(DefaultJavaSdkMajorVersion)
+          useAgentJdkPath: true
+          use1ESTemplate: ${{ parameters.use1ESTemplate }}
+    - ${{ else }}:
+      - template: /build-tools/automation/yaml-templates/setup-test-environment.yaml
+        parameters:
+          use1ESTemplate: ${{ parameters.use1ESTemplate }}
 
     - task: DownloadPipelineArtifact@2
       inputs: