[CI] /review trigger blocked by Entra Conditional Access (AADSTS53003)

## Summary

Every `/review` command currently reaches the **Review Trigger** GitHub Actions workflow, acquires `s/agent-review-in-progress`, then fails before Azure DevOps pipeline `27723` is queued. Cleanup consequently removes the label, making the command look as though it was ignored.

The GitHub OIDC token is valid, but Microsoft Entra rejects the workload-identity exchange for the Azure DevOps access token:

```text
AADSTS53003: Access has been blocked by Conditional Access policies.
The access policy does not allow token issuance.
```

## Impact

- 14 trigger runs failed across 11 unique PRs from 2026-08-27 21:14 UTC through 2026-08-28 13:26 UTC.
- No corresponding `maui-copilot` build was created by those GitHub workflows.
- The workflow immediately clears `s/agent-review-in-progress` after the failed exchange.
- The missed reviews had to be queued manually with `az pipelines run`.

Affected PRs: #37307, #37750, #37855, #37863, #37895, #37896, #37897, #37942, #37944, #37945, and #37946.

## Evidence

The same workflow revision succeeded and then failed without a repository change:

- Last successful exchange: [Review Trigger run 33102095055](https://github.com/dotnet/maui/actions/runs/33102095055), 2026-08-27 18:10 UTC
- Workflow SHA: `90e5e934180bf2217180fea7e4b0c37d03f7514b`
- Queued Azure build `15121221`
- First denial: [Review Trigger run 33117142979](https://github.com/dotnet/maui/actions/runs/33117142979), 2026-08-27 21:14 UTC
- Same workflow SHA: `90e5e934180bf2217180fea7e4b0c37d03f7514b`
- Trace ID: `fe52fd12-ed22-4cbc-b1dd-fc5013a93600`
- Correlation ID: `058da9c3-bdd9-4049-9806-dfa862c65abe`
- Recent denial: [Review Trigger run 33175308896](https://github.com/dotnet/maui/actions/runs/33175308896), 2026-08-28 13:25 UTC
- Trace ID: `ac52056c-0eea-4635-ae46-a36157115400`
- Correlation ID: `3a318f5f-d003-4f70-bf36-11fc18099fbd`

Repository secrets `AZDO_TRIGGER_CLIENT_ID` and `AZDO_TRIGGER_TENANT_ID` have not changed since 2026-06-18.

## Workload identity

| Property | Value |
|---|---|
| Display name | `Testing-MI-gh2zdo` |
| Application/client ID | `ebbdc3aa-01e4-4b23-b2e4-b91a4ac40beb` |
| Service-principal object ID | `98932f4c-10e3-4d26-8703-b6afe7ae3c0f` |
| Tenant | `72f988bf-86f1-41af-91ab-2d7cd011db47` |
| Account enabled | `true` |
| Requested resource | Azure DevOps, `499b84ac-1321-427f-aa17-267ca6975798` |
| GitHub OIDC subject | `repo:dotnet/maui:ref:refs/heads/main` |

## Required action

An Entra Conditional Access administrator should inspect the service-principal sign-ins using the trace/correlation IDs above and identify the policy that began blocking this workload identity between 18:10 and 21:14 UTC on August 27.

Apply the narrowest compliant correction, for example:

- exclude this specific managed identity from the newly applied blocking workload-identity policy, or
- permit its GitHub Actions workload-identity location/conditions, or
- provision another approved workload identity or runner path with access to queue DevDiv pipeline `27723`.

Do **not** replace OIDC with a personal Azure DevOps PAT.

## Acceptance criteria

- [ ] Entra issues an Azure DevOps token for the existing GitHub OIDC subject.
- [ ] `/review -b improved-reviewer -p android` queues pipeline `27723` without manual intervention.
- [ ] `s/agent-review-in-progress` remains until the Azure pipeline's cleanup stage.
- [ ] The solution remains PAT-free and scoped only to the reviewer trigger identity.

## Temporary recovery

The 11 unique missed reviews were manually queued as Azure builds `15132189`-`15132199`, `15132214`, `15132218`, and `15132219`; all entered the `Review Pull Request` stage, and their in-progress labels were restored.

Start with the Review Trigger GitHub Actions workflow and the /review command path, then inspect Entra service-principal sign-ins using the supplied trace and correlation IDs. Verify the existing GitHub OIDC subject can obtain an Azure DevOps token and that /review -b improved-reviewer -p android queues pipeline 27723 without a PAT; confirm the in-progress label remains until pipeline cleanup.

Written by the indexing model from the issue text.