feat(integrations): add Azure DevOps MCP catalog entry

[jpelletier1]

• A human has tested these changes.

---

Why

Agent Canvas had no Azure DevOps entry in the MCP integration marketplace, even though azure_devops is already a recognized git/auth provider in the OpenHands codebase (icon, URL parsing, dropdown support). This surfaces the official Microsoft Azure DevOps MCP Server so agents can act on Azure DevOps resources (work items, repos, pipelines, wikis, test plans) directly from the Agent Canvas MCP UI.

Summary

• Adds integrations/catalog/azure-devops.json with two connection options:
  • Remote (recommended, public preview): Azure DevOps-hosted streamable HTTP endpoint at https://mcp.dev.azure.com/{organization}, Microsoft Entra ID (OAuth) auth, editable URL so users fill in their organization name.
  • Local (PAT): stdio via npx -y @azure-devops/mcp --authentication pat, with the organization passed as a CLI argument and the PAT supplied through the documented PERSONAL_ACCESS_TOKEN env var (base64-encoded :PAT).
• Adds the Azure DevOps logo asset under integrations/icons/azure-devops.svg and points logoUrl at it.
• Regenerates integrations/catalog-index.js.
• Adds test_azure_devops_entry_contract to tests/test_catalogs.py locking in the entry's contract (remote OAuth + local PAT options, logo, env/arg fields); the existing schema/in-sync tests parametrize over the new entry automatically.

Issue Number

Closes OpenHands/OpenHands#15769

How to Test

pip install -e .
pip install jsonschema pytest
pytest tests/test_catalogs.py tests/test_catalog_schema.py tests/test_integration_catalog_in_sync.py
node --input-type=module -e "import { getIntegrationCatalogEntry } from './integrations/index.js'; console.log(getIntegrationCatalogEntry('azure-devops').connectionOptions.map(o=>o.id))"

The azure-devops entry should appear in listIntegrationCatalog({ mcp: true }) and listIntegrationCatalog({ oauth: true }). Once consumed by Agent Canvas (dep bump in that repo), it surfaces in the MCP marketplace and the install modal offers the local PAT stdio path.

Notes

• The catalog schema does not support dynamic URL field substitution (urlFields), so the remote option uses urlEditable: true with the documented {organization} placeholder URL — users edit it to their real organization URL in the install dialog, matching the Datadog pattern.
• Verified the official @azure-devops/mcp@2.7.0 CLI: --authentication pat reads PERSONAL_ACCESS_TOKEN (base64-encoded, used directly as the Basic auth credential) and accepts the organization positional before or after flags. Helper text documents the base64 encoding requirement.
• The OAuth authorizationUrl/tokenUrl use the Microsoft Entra common endpoints with the Azure DevOps resource scope (499b84ac-.../.default); the hosted MCP server performs MCP-spec OAuth with Entra. Agent Canvas handles hosted-MCP OAuth via the agent-server backend.

This PR was created by an AI agent (OpenHands) on behalf of the OpenHands team.

@jpelletier1 can click here to continue refining the PR

[enyst]

I'm an AI agent (Claude Code, based on Opus 5.5) helping Engel Nyst (@enyst) with project work.

I recommend closing this in favour of #716, which adds the same entry on current main and fixes the problems below. I'm not suggesting a rework of this branch: it is a draft, 142 commits behind main, and conflicts in integrations/catalog-index.js.

Against current main, this head has three problems:

1. azure-devops.json#L64: the organization argField has no type, and main's schema now requires one. With this file on main, 13 catalog tests fail. The Python model loader also raises, which breaks list_integration_catalog_models() for the whole catalog, not only this entry.
2. #L32-L35: the OAuth block hard-codes Entra common endpoints and the Azure DevOps REST API scope 499b84ac-.../.default. The MCP server's protected-resource metadata advertises a different scope, https://mcp.dev.azure.com/.default, under the organizations/v2.0 authority. Microsoft's docs also say Entra doesn't support DCR, so a registered client ID is needed in any case. #716 leaves this to MCP discovery with a registered client and documents that in notes.
3. #L43: the default URL contains a literal {organization}, and nothing in the catalog substitutes it. Microsoft documents the base https://mcp.dev.azure.com/ as valid, with the organization supplied in each tool call. #716 uses that URL.

#716 keeps the same PAT/stdio command (--authentication pat, base64 PERSONAL_ACCESS_TOKEN, organization as a positional argument), which is correct here too.