fix(safe-outputs): reject cross-organization repos in create-pull-request

[Copilot]

Summary

create-pull-request composes every Azure DevOps Git REST call from the pipeline's own organization/project, so a repos: alias checked out from a different organization via an endpoint: service connection resolves against the wrong org and fails with a confusing 404 — invisible under --dry-run, which skips the API call entirely.

Changes

• Detection: FrontMatter::checkout_cross_organization_repo_aliases() flags checked-out repos: aliases that are type: git with endpoint: set — the existing documented signal for a cross-organization repository.
• Compile-time warning: the compiler now warns when create-pull-request is enabled alongside a cross-organization alias, surfacing the mismatch before the pipeline ever runs.
• Runtime + dry-run rejection: ExecutionContext gains cross_organization_repositories, threaded through both execution paths (--source front-matter and compiled --resolved-config). create-pull-request's executor now rejects a cross-organization target with a clear, actionable error before the dry-run short-circuit, so --dry-run reports the real failure instead of a false "would execute" success.
• Docs: docs/safe-outputs.md and docs/front-matter.md document the limitation.

This does not implement full cross-organization support (composing the request against the alias's own organization via its endpoint: credential) — resolving a credential for another Azure DevOps organization at Stage 3 is a larger follow-up. This change turns a silent, delayed failure into an immediate, actionable one.

repos:
  - One/azlocal-overlay
  - name: AzureForOperatorsIndustry/nc-api-testing
    endpoint: afoi-x-org-pipeline   # flagged as cross-organization
safe-outputs:
  create-pull-request:

Compiling this now warns, and targeting nc-api-testing at runtime (or under --dry-run) fails with an explicit "cross-organization" error instead of a wrong-org 404.

Test plan

• cargo test --bin ado-aw and cargo test --test compiler_tests
• cargo clippy --all-targets
• Manual compile of a front-matter file mirroring the issue's repos: shape, confirming the warning fires and compilation still succeeds

• Fixes [agent-issue]: create-pull-request cannot target a repository from another Azure DevOps organisation #1934

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.