feat: Azure DevOps PR-flow rails + dual-platform docs (kit sync)

[splashthree]

Companion to claude-code-sdlc PR #47 (Azure DevOps repo support). The plugin's harness/ is a generated copy of this repo's kit/, and its CI pins byte-identity against main — so the harness changes from that PR's Folds C+D need to land here first. Merge order: this PR, then #47 (its "harness == kit" check goes green once this is on main).

What

• kit/hooks/review-gate.{sh,ps1} — az repos pr create becomes a gated trigger alongside git push / gh pr create. Two hardenings that also strengthen the existing triggers, stated plainly: leading VAR=value prefixes are stripped before matching (AZURE_DEVOPS_EXT_PAT=... az repos pr create is a documented az auth pattern and walked past the gate — as did FOO=1 git push), and the ps1 twin now splits segments on newlines like the sh twin always did (a multi-line command with the trigger on a later line bypassed it on Windows).
• kit/packs/cicd/azure-devops/settings.fragment.json (new) + pack.yaml overlay — the ADO twins of the core settings' GitHub entries: read-only az repos pr show/list + az pipelines runs/build queries allowed (note: az has no pr view — that's gh vocabulary), mutating az repos policy / az devops invoke / configure-branch-policies.sh behind ask, .azuredevops/** gated like .github/**.
• kit/skills/pr-writer/SKILL.md — open step names both platforms; --labels risk:high verified against the live az CLI.
• Kit docs (HARNESS.md, README.md install map, CLAUDE.md.template examples) — describe the .azuredevops/ layout the plugin's platform-aware installer now produces (pipelines in .azuredevops/pipelines/, rubrics/ledgers in .azuredevops/rails/, branch policies replacing ruleset+CODEOWNERS).
• .gitattributes (repo root, new) — *.sh text eol=lf: an autocrlf Windows clone of this repo ships hook/rails scripts bash cannot execute (set -uo pipefail\r). The plugin repo hit exactly this on its Windows CI leg and now carries the same pin.

Verification

• sync_kit.py --check against the plugin working tree: IN SYNC, 139 files — this PR and plugin PR #47 are byte-identical mirrors.
• Hook behavior: the plugin's new test_review_gate_hook.py runs the real .sh hook against a 14-case trigger table (adversarial forms included) on ubuntu + windows, and the .ps1 twin's table went green on its first real execution (Windows CI).
• GitHub-path behavior: unchanged except the two named hardenings; the plugin's golden-tree and byte-diff checks stayed green at every commit.

🤖 Generated with Claude Code