Scope PR-triggered prepare-pipelines runs to changed pipeline YAML

## Problem

PR-triggered `prepare-pipelines` runs process pipelines beyond the files changed by the pull request. A new push can cancel the run after it has made only some Azure DevOps changes, leaving a pipeline definition present but missing required resource permissions.

This occurred while running `prepare-pipelines` from [Azure/azure-sdk-for-python#48635](https://github.com/Azure/azure-sdk-for-python/pull/48635). The run created the pipeline needed by [Azure/azure-sdk-for-js#39661](https://github.com/Azure/azure-sdk-for-js/pull/39661), but was canceled before permission setup completed. The JavaScript release subsequently stopped with:

> This pipeline needs permission to access a resource before this run can continue to Build

## Timeline

- September 3, 2026, 7:19 PM PDT: `/azp run prepare-pipelines` was posted on the Python PR.
- 7:19 PM: Azure DevOps queued build `6788099`; it started at 7:22 PM.
- 7:24 PM: commit [`b033b7a7`](https://github.com/Azure/azure-sdk-for-python/pull/48635/changes/b033b7a7d18788dae7a8dc499b3b367d66efbb43) was pushed to the PR.
- 7:24 PM: the build was canceled and deleted. The pipeline definition had been created, but the run had not completed permission configuration.
- September 4: the affected JavaScript release pipeline could not continue without manual resource authorization.

## Proposed changes

- For PR-triggered runs, inspect the PR diff and prepare only pipelines represented by changed pipeline YAML files.
- Run the complete `prepare-pipelines` reconciliation nightly across all SDK repositories to apply missed definitions, permissions, and configuration drift.
- Preserve the existing full-run path for manual or scheduled reconciliation.

This complements #16921, which covers preparing and queueing release pipelines after an auto-release SDK PR merges.

## Acceptance criteria

- A PR-triggered run does not create or update pipelines unrelated to that PR's changed pipeline YAML.
- Relevant pipeline definitions and required resource permissions are applied in the same targeted run.
- A nightly full reconciliation repairs missed or incomplete pipeline configuration.
- A push to one SDK PR cannot leave another SDK repository's pipeline partially configured.

Start at the prepare-pipelines entry point and trace how PR-triggered runs select pipelines and apply Azure DevOps definitions and permissions. Use the pull request diff to limit targeted work to changed pipeline YAML files, while preserving the manual or scheduled full-run path. Done means targeted runs configure only relevant pipelines completely and nightly reconciliation repairs missed or incomplete configuration.

Written by the indexing model from the issue text.