feat(scanner): migrate security operations and supply chain rules (AZ-SECOPS-001 to 010, AZ-SC-001 to 008) to the evaluate() contract #375

What problem does this solve?

The security operations rules (AZ-SECOPS-001 to AZ-SECOPS-010: Defender, Sentinel, logging, retention) and supply chain rules (AZ-SC-001 to AZ-SC-008: registries and Azure DevOps service connections) depend on dedicated collectors outside AzureClient. These rules only implement scan(), so the engine reports their coverage as UNKNOWN / LEGACY_RULE_NOT_MIGRATED, and every compliance control mapped to them reads UNKNOWN in the evaluation-derived reports introduced in #310.

Describe the solution

Migrate the rules below to the evaluate() contract defined in scanner/evaluation.py, following the storage reference implementation (STORAGE_REF).

Rules in scope: az_secops_001 … az_secops_010, az_sc_001 … az_sc_008, plus _security_operations_common.py.

Notes: DevOpsClient.get_service_endpoints() already returns None on failure. When Azure DevOps is not configured at all, report NOT_APPLICABLE / INTEGRATION_NOT_CONFIGURED, which is distinct from ERROR / INVENTORY_UNAVAILABLE when it is configured but unreachable. Apply the same rule to scanner/security_operations.py collectors.

Status mapping

Every path that scan() currently handles with a silent continue must become an explicit status:

A failed inventory call must never produce PASS or NOT_APPLICABLE.

Acceptance criteria

• Each rule in scope exposes evaluate(azure_client, subscription_id) -> List[RuleEvaluation] using the shared helpers in scanner/evaluation.py.
• scan() becomes a thin wrapper returning the findings attached to FAIL evaluations.
• Detection is unchanged: for the existing test fixtures, scan() returns exactly the same findings as before the change.
• Each FAIL / PASS evaluation records the inspected value(s) in evidence, for example {"allow_blob_public_access": true}.
• New tests cover the PASS, FAIL, UNKNOWN, NOT_APPLICABLE and inventory-failure paths for every rule in scope.
• The rules are picked up automatically by tests/test_rule_evaluation_contract.py and it passes.
• pytest, ruff check . and ruff format --check . pass.
• CHANGELOG.md updated under Unreleased.

Alternatives considered

Migrating one rule at a time was considered. Grouping by family lets each PR add the family's inventory helper once and review the shared common module once.

Additional context

• Blocked by feat(scanner): evaluate() contract foundation - fallible inventory, shared helpers, single engine path #369 STORAGE_REF=feat(scanner): migrate storage rules AZ-STOR-001 to 010 to the evaluate() contract #370.
• Existing tests: tests/test_rules_security_operations_*.py, tests/test_rules_supply_chain.py, tests/test_devops_client.py
• Core-team scope: these rules depend on shared collectors and multi-call evidence, so the status mapping needs careful review.