[KB-5] knowledge_base: ci_cd_github_actions and ci_cd_azure_devops #16

Roadmap ID: KB-5

Minimal pipelines: OIDC / workload-identity auth, validate on PR, deploy -t staging on merge, manual prod gate, pinned databricks_cli_version. Only mlops_stacks has CI today; no Azure DevOps anywhere.

Acceptance criteria

• Workflows pass .github/conftest/rules
• No PATs
• README covers federation policy setup
• Concurrency group prevents parallel deploys to one target

Edge-case checklist

• AWS / Azure / GCP support matrix (storage URIs, identity, node types, region availability)
• Serverless vs classic both validated, or the unsupported one documented
• No secrets in templates; use secret scopes / workload identity
• Dev schedules paused; no always-on costly resources in tests
• Re-deploy is idempotent; an interrupted deploy is safe to retry
• Teardown only removes resources the example owns

Source: repo gap audit of knowledge_base/ and contrib/ (2026-10-21).