refactor: rename Stage 3 Execution job to SafeOutputs (#544)

Author: Copilot

src/compile/common.rs

@@ -1854,7 +1854,7 @@ pub fn generate_teardown_job(
     let template = format!(
         r#"- job: Teardown
   displayName: "Teardown"
-  dependsOn: Execution
+  dependsOn: SafeOutputs
   pool:
     {{{{ pool }}}}
   steps:
@@ -6217,7 +6217,7 @@ mod tests {
         let step: serde_yaml::Value = serde_yaml::from_str("bash: echo td").unwrap();
         let out = generate_teardown_job(&[step], "name: MyPool");
         assert!(out.contains("- job: Teardown"), "out: {out}");
-        assert!(out.contains("dependsOn: Execution"), "out: {out}");
+        assert!(out.contains("dependsOn: SafeOutputs"), "out: {out}");
         assert!(out.contains("name: MyPool"), "out: {out}");
         assert!(out.contains("echo td"), "out: {out}");
     }

src/compile/onees.rs

@@ -134,7 +134,7 @@ fn generate_teardown_job(teardown_steps: &[serde_yaml::Value]) -> String {
     format!(
         r#"- job: Teardown
   displayName: "Teardown"
-  dependsOn: Execution
+  dependsOn: SafeOutputs
   templateContext:
     type: buildJob
     steps:
@@ -190,8 +190,8 @@ mod tests {
             "Should use simple display name"
         );
         assert!(
-            result.contains("dependsOn: Execution"),
-            "Should depend on Execution"
+            result.contains("dependsOn: SafeOutputs"),
+            "Should depend on SafeOutputs"
         );
         assert!(result.contains("checkout: self"), "Should include self checkout");
         assert!(result.contains("echo teardown"), "Should include the step content");

src/data/1es-base.yml

@@ -617,8 +617,8 @@ extends:
                   displayName: "Copy logs to output directory"
                   condition: always()
 
-          - job: Execution
-            displayName: "Execution"
+          - job: SafeOutputs
+            displayName: "SafeOutputs"
             dependsOn:
               - Agent
               - Detection

src/data/base.yml

@@ -591,8 +591,8 @@ jobs:
         artifact: analyzed_outputs_$(Build.BuildId)
         condition: always()
 
-  - job: Execution
-    displayName: "Execution"
+  - job: SafeOutputs
+    displayName: "SafeOutputs"
     dependsOn:
       - Agent
       - Detection

src/data/job-base.yml

@@ -578,8 +578,8 @@ jobs:
         artifact: analyzed_outputs_$(Build.BuildId)
         condition: always()
 
-  - job: {{ stage_prefix }}_Execution
-    displayName: "Execution"
+  - job: {{ stage_prefix }}_SafeOutputs
+    displayName: "SafeOutputs"
     dependsOn:
       - {{ stage_prefix }}_Agent
       - {{ stage_prefix }}_Detection

src/data/stage-base.yml

@@ -582,8 +582,8 @@ stages:
           artifact: analyzed_outputs_$(Build.BuildId)
           condition: always()
 
-    - job: {{ stage_prefix }}_Execution
-      displayName: "Execution"
+    - job: {{ stage_prefix }}_SafeOutputs
+      displayName: "SafeOutputs"
       dependsOn:
         - {{ stage_prefix }}_Agent
         - {{ stage_prefix }}_Detection

tests/compiler_tests.rs

@@ -95,7 +95,7 @@ fn assert_required_markers(content: &str) {
 /// Asserts that the pool configuration uses the `{{ pool }}` marker everywhere
 /// and that no hardcoded pool name leaks into the template.
 fn assert_pool_config(content: &str) {
-    // Must appear once per job: Agent, Detection, Execution.
+    // Must appear once per job: Agent, Detection, SafeOutputs.
     let pool_marker_count = content.matches("{{ pool }}").count();
     assert_eq!(
         pool_marker_count, 3,
@@ -3509,8 +3509,8 @@ fn test_1es_compiled_output_is_valid_yaml() {
         "1ES output should contain Detection job"
     );
     assert!(
-        compiled.contains("job: Execution"),
-        "1ES output should contain Execution job"
+        compiled.contains("job: SafeOutputs"),
+        "1ES output should contain SafeOutputs job"
     );
 
     // Verify no Agency remnants