[Promotion] Add Org Announcements authoring support

[SophieS0ng]

Summary

Promote the reviewed Org Announcements authoring stack from
users/rebova/org-announcements-prerelease to main.

This PR consolidates the previously reviewed and merged implementation slices
into the final repository promotion boundary. It also removes the temporary CI
branch filters that were added only to support the stacked review process.

Included work

• [1/5] Share authoring identity and deployed-agent discovery #269 — shared authoring identity and deployed-agent discovery
• [2/5] Add agent-scoped announcement models and authoring client #270 — Org Announcements contracts and authoring client
• [3/5] Add account-bound Graph audience discovery #271 — account-bound Microsoft Graph audience discovery
• [4/5] Expose the scoped announcement MCP runtime #272 — scoped MCP authoring runtime and provider coverage
• [5/5] Wire announcement maker entry points and setup #273 — Maker skill, setup materialization, packaging, and entry points
• [6/6] Migrate announcement authoring to the OData contract #346 — migration to the WeveNova OData contract and integration follow-ups

Together, these changes provide:

• shared deployed-agent discovery and account-bound authentication
• Org Announcements create, read, update, delete, publish, schedule, archive,
  duplicate, and audience-selection contracts
• WeveNova OData request/response adaptation
• Microsoft Graph user and group audience discovery
• MCP tools and hosted-widget protocol support
• Maker skill instructions and setup/package integration
• privacy-safe diagnostics and credential-recovery guidance

CI cleanup

The following temporary pull-request target filters were required while the
stacked PRs targeted user branches:

• users/rebova/org-announcements-prerelease
• users/rebova/org-announcements-review-*

Now that the complete stack is merged into the prerelease branch, this PR
removes both filters and updates
tests/mcp/agentconfig_core/test_ci_contract.py accordingly.

Normal CI coverage for main and release/** is preserved.

Validation

Local validation on September 28, 2026:

• Org Announcements configuration tests
• Foundation setup router tests
• 742 tests passed
• CI contract cleanup test: 1 passed
• git diff --check passed

The promotion PR targets main, so the repository's normal main-target CI
should run without the temporary user-branch filters.

Release validation

This PR is the consolidated code-review and CI boundary. The individual stack
merges established the reviewed implementation on the prerelease branch; they
did not independently approve production rollout.

The following live validation remains separate from the offline test coverage:

• authorized Microsoft Graph integration
• deployed WeveNova Authoring service integration
• hosted Vorpal widget integration
• end-to-end Admin authoring validation
• final rollout and release approval

Review request

Please review the complete prerelease-to-main integration and confirm:

• the stacked implementation is ready to enter main
• the temporary CI review-branch configuration has been fully removed
• the remaining live integration work is recorded accurately
• no additional release-branch promotion step is required

This PR should remain a draft until the final promotion target and required
release gates are confirmed.

[Apurva Banka (apurvabanka)]

Reviewed the full diff and ran the suites locally: tests/mcp + tests/setup/test_org_announcements_integration.py + tests/scripts/test_maker_profile_vsix.py → 1186 passed, 22 skipped, and ruff check is clean. The lifecycle handling here is genuinely careful — the committed-vs-failed write distinction, the compare-and-swap client/token invalidation, and the content-free telemetry allowlist are all well done. A few gaps worth addressing before merge:

1. Interactive sign-in failures surface as InvalidRequest (high)

_construct_and_publish_client (server.py ~L314) catches (LocalCredentialError, LockException, OSError). But acquire_token_msal_interactive raises a plain ValueError in two cases — MSAL failure (base_client.py ~L205) and the 300-second browser-callback timeout (~L275) — and since LocalCredentialError is a ValueError subclass, the plain case isn't caught. It escapes to _to_failure, which falls through to _FailureResult("InvalidRequest", str(error)).

That routes a sign-in timeout to the wrong maker guidance. Per org-announcements/SKILL.md L400, InvalidRequest means "Explain what to change; do not retry the same call" — but a browser-callback timeout is precisely a retryable AuthenticationRequired. The existing coverage (test_mcp_app_protocol.py:2501) only exercises the LocalCredentialError path, so the gap isn't caught.

Suggested fix: widen the catch to (ValueError, LockException, OSError) — it already maps to AuthenticationRequired.

2. tests/setup/test_da_setup_router.py runs in no CI job (medium)

The new org-announcements job lists only tests/setup/test_org_announcements_integration.py. test_da_setup_router.py is modified by this PR but isn't executed by any job in ci.yml. Either run tests/setup wholesale or add the file explicitly.

3. Discovery tools don't catch ValueError (medium)

list_agent_configs and search_agents catch (_FailureResult, AgentConfigApiError, httpx.RequestError). A ValueError — from search_agents input validation, from _validate_https_base_url on a bad ORG_ANNOUNCEMENTS_BASE_URL, or from issue 1 above — escapes as an unstructured FastMCP error with no telemetry event emitted. Every other tool in the file includes ValueError in its handler; these two look like an oversight.

Minor / non-blocking

• search_audience_groups returns {status, code, retryable} on failure, while the mutation tools return {...scope, status, errors[]}. If that asymmetry is deliberate it's worth a comment, since the widget has to branch on two failure shapes.

• Neither _client nor _graph_client is closed on server shutdown. Process exit covers it in practice, but there's no lifespan hook — worth noting if the server is ever hosted in-process.

• agent_discovery._to_api_payload is unused within its own module (it exists for the landing-page client's import). A one-line comment would save the next reader a grep.