ci(prcheck): split pipeline script into client + thin runner

Refactor the prcheck pipeline script in preparation for a second runner
that submits package builds. No behavior change.

* Move .github/workflows/scripts/control-tower-prcheck/ to
  .github/workflows/scripts/control-tower/.
* Extract HTTP/auth/polling helpers from run_control_tower_prcheck.py
  into a shared client.py module (post_scenario, get_job_status,
  poll_until_terminal, etc.).
* Rename the runner to run_prcheck.py and reduce it to a thin CLI on
  top of client.py.
* Update the sources-upload stages template to point at the new
  script paths.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: dmcilvaney

.github/workflows/ado/sources-upload.yml

@@ -23,7 +23,7 @@
 #   Name: "ControlTower-PRCheck"
 #   Required variables:
 #     - ApiAudience          : Entra ID audience URI for the Control Tower app
-#     - ApiBaseUrl           : Base URL of the Control Tower service
+#     - ApiBaseDirectUrl     : Direct base URL of the Control Tower APIM endpoint (bypasses Azure Front Door)
 #     - AzldevCommit         : Commit hash for azldev (go install ...@<commit>)
 
 # Trigger controlled by ADO branch policy — not YAML triggers.

.github/workflows/ado/templates/sources-upload-stages.yml

@@ -111,7 +111,7 @@ stages:
               echo "##[endgroup]"
 
               echo "##[group]Python dependencies"
-              pip install -r .github/workflows/scripts/control-tower-prcheck/requirements.txt
+              pip install -r .github/workflows/scripts/control-tower/requirements.txt
               echo "##[endgroup]"
             displayName: "Install dependencies"
             env:
@@ -200,7 +200,7 @@ stages:
               inlineScript: |
                 set -euo pipefail
 
-                python3 .github/workflows/scripts/control-tower-prcheck/run_control_tower_prcheck.py \
+                python3 .github/workflows/scripts/control-tower/run_prcheck.py \
                   --api-audience "$API_AUDIENCE" \
                   --api-base-url "$API_BASE_URL" \
                   --build-reason "$BUILD_REASON" \
@@ -209,7 +209,7 @@ stages:
                   --repo-uri "$UPSTREAM_REPO_URL"
             env:
               API_AUDIENCE: $(ApiAudience)
-              API_BASE_URL: $(ApiBaseUrl)
+              API_BASE_URL: $(ApiBaseDirectUrl)
               BUILD_REASON: $(Build.Reason)
               COMPONENTS: $(components)
               SOURCE_COMMIT: $(sourceCommit)