Migrate CI to dnceng with Arcade publishing

[mattleibow]

Summary

• move unsigned public build/pack/test validation from xamarin/public to dnceng-public/public
• replace the DevDiv internal build with the released 1ES Official template and dnceng internal pools
• add repository-owned signing and API Scan stages, with protected identities structurally excluded from public and PR builds
• onboard the same isolated Arcade SDK and generated eng/common foundation used by SkiaSharp
• produce one immutable package family per run and prepare Shipping packages, .snupkg symbol blobs, and loose PDBs
• sign internal Shipping assets, generate an Arcade V3 manifest, register assets in BAR, validate them, and require Maestro default-channel promotion

The product API and runtime behavior are unchanged.

Current dnceng status

Role	Project	Definition	Source	YAML	Status
Public validation	dnceng-public/public	\mono\mono-SkiaSharp.Extended (ID 346)	GitHub mono/SkiaSharp.Extended	azure-pipelines-public.yml	Created with the correct source/YAML, but disabled by automatic decluttering after 30 days with no queued builds
Internal package	dnceng/internal	Proposed \dotnet\skiasharp\skiasharp-extended-package	mirror dotnet-SkiaSharp.Extended	azure-pipelines.yml	Not created yet

The dnceng mirror is enabled and synchronized with GitHub for both main and release/2.x.

Infrastructure work required

• re-enable public definition 346 and queue its first validation run
• create the internal package definition against dotnet-SkiaSharp.Extended
• authorize NetCore1ESPool-Internal and NetCore1ESPool-Publishing-Internal
• authorize Arcade's dnceng MicroBuild/PME real-signing connection
• authorize the dotnet-apiscan WIF connection
• authorize Darc: Maestro Production and the standard Arcade publishing variables/tokens
• map SkiaSharp.Extended branches to the same required Maestro default-channel policy as SkiaSharp
• keep DevDiv definition 10846 and Xamarin definition 6 until replacement runs are green, then disable them

TSA continues to route findings to the existing DevDiv area because that configuration controls security bug ownership, not pipeline hosting.

Package and release behavior

Public PRs remain unsigned and cannot expand signing, API Scan, BAR, or promotion stages. Internal main and release/* builds real-sign and register automatically; trusted feature builds test-sign unless explicitly forced, and forced BAR registration requires a separate opt-in. Exact stable packages are restricted to internal release/* builds. NuGet.org publication remains a protected team-owned handoff after BAR.

Validation

• build identity and Arcade asset-assembly test scripts
• dotnet cake --target=pack
• dotnet cake --target=build
• dotnet cake --target=test
• local Arcade V3 manifest generation with two package assets and two SNORPKEG symbol blobs
• YAML parsing, API Scan extraction, protected-stage guard review, and focused code review

References

Follows mono/SkiaSharp#4368, mono/SkiaSharp#4800, mono/SkiaSharp#4802, mono/SkiaSharp#4803, mono/SkiaSharp#4840, and mono/SkiaSharp#4859.

[github-actions]

📖 Documentation Preview

The documentation for this PR has been deployed and is available at:

🔗 View Staging Documentation

🔗 View Staging Blazor Sample

This preview will be updated automatically when you push new commits to this PR.

---

This comment is automatically updated by the documentation staging workflow.