[Parent] MCPG infrastructure and safe-output tooling improvements

Umbrella tracking issue for bugs and improvements spanning the **MCP Gateway (MCPG) infrastructure** and the **safe-output tool implementations** — the two subsystems that form the agent tooling layer.

## MCPG infrastructure

Issues with how ado-aw generates and wires the MCPG container step, and how failures are surfaced:

- #1034 — MCPG step fails with docker: invalid reference format (extra `\\` after `-e ADO_MCP_AUTH_TOKEN` in generated YAML)
- #945 — Custom MCP container env passthrough never reaches the server (step env mapping missing)
- #621 — Noop smoke pipeline fails to pull non-existent `ghcr.io/github/gh-aw-mcpg:v0.3.7` (manifest unknown)
- #254 — feat: surface MCPG backend failures in pipeline logs

## Safe-output tooling

Bugs and improvements in the safe-output tool implementations that agents use to propose write actions:

- #1103 — add-pr-comment: render inline threads as applyable single/multi-line suggestions
- #381 — fix(safe-outputs): add file staging to upload-workitem-attachment
- #471 — upload-pipeline-artifact fails with ContainerWriteAccessDeniedException when uploading to other builds

> Generated by [Issue Arborist](https://github.com/githubnext/ado-aw/actions/runs/28620342313) · 61.8 AIC · ⌖ 6.99 AIC · ⊞ 6K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fado-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fado-aw%2Fissue-arborist%22&type=issues)

Treat this as an umbrella tracker rather than a single contribution, and begin by choosing one referenced issue: #1034, #945, #621, #254, #1103, #381, or #471. Read that child issue first; this tracker is complete when its listed MCPG or safe-output problems have been resolved, not when the umbrella text itself changes.

Written by the indexing model from the issue text.