refactor(engine): emit typed install steps instead of YAML strings

## Context

This refactor is prompted by PR #1824 review threads:
- https://github.com/githubnext/ado-aw/pull/1824#discussion_r3724479152
- https://github.com/githubnext/ado-aw/pull/1824#discussion_r3724480508 (reply to discussion_r3724479152)
- https://github.com/githubnext/ado-aw/pull/1824#discussion_r3724495467

`copilot_install_steps` currently returns rendered YAML strings, which forces `resolve_ado_organization_bash(indent)` and another format string. That conflicts with the IR rule that compiler-generated steps should use typed step representations (`Step::Bash`, `BashStep`, `TaskStep`) and that lowering should own YAML indentation.

This should be addressed across the engine and every target caller so compiler-generated install steps become typed `Vec` (or an equivalent typed representation), while genuinely user-authored YAML remains the only RawYaml escape hatch.

## Requirements

- Refactor generated install steps so they are emitted as typed steps rather than rendered YAML strings.
- Make the organization resolver return an unindented script or a typed BashStep rather than a string that requires caller-side indentation logic.
- Remove the need for callers to pass indentation for generated install steps.
- Ensure 1ES organization resolution, NuGet auth, and install steps are typed.
- Preserve standalone/1ES/job/stage output behavior.
- Ensure the IR graph/summary can see the generated steps.
- Keep compile fixtures and bash lint passing.

## Acceptance

- Organization resolution returns an unindented script or typed BashStep.
- No caller passes indentation for generated install steps.
- 1ES organization resolution/NuGet auth/install steps are typed.
- Standalone/1ES/job/stage output behavior is preserved.
- IR graph/summary sees the steps.
- Compile fixtures and bash lint pass.