fix(auth): Azure DevOps az-CLI token returns None on undecodable output instead of crashing

[jawwad-ali]

What

AzureDevOpsAuth._acquire_via_az_cli runs az account get-access-token with text=True, then parses the JSON:

result = subprocess.run([...], capture_output=True, text=True, ...)
...
payload = _json.loads(result.stdout)
...
except (OSError, subprocess.TimeoutExpired, _json.JSONDecodeError, KeyError):
    return None

With text=True, subprocess.run decodes stdout using the locale encoding, so if az emits bytes that aren't decodable there it raises UnicodeDecodeError inside run() — before json.loads ever runs. UnicodeDecodeError is a ValueError sibling but not a JSONDecodeError, so it isn't caught and it crashes a helper whose entire contract is to return str | None.

Fix

Add UnicodeDecodeError to the except tuple so undecodable output degrades to None like every other failure mode. One-token change; direction unambiguous given the str | None return contract and the sibling encoding guards elsewhere in the codebase.

Test

test_resolve_token_azure_cli_undecodable_output_returns_none patches subprocess.run to raise UnicodeDecodeError and asserts resolve_token(...) is None — fails before (the error propagated), passes after.

---

🤖 Written with the assistance of Claude Code (AI). Bug self-found; fix/tests verified locally (fail-before / pass-after), ruff clean.