Use a Windows pool for the 1ES SDL stage in docker-image-refresh (#3669)

The 1ES Official template injects an SDL source-analysis stage that must run on a Windows pool; the template-level pool was Linux, causing 'Please specify a windows pool for SDLSources stage'. Set template-level pool to the Windows pool (1es-windows-ps-compute-m) and keep the Linux pool override on the container build job, mirroring sdk-release.yml.


Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: gavinbarron

.azure-pipelines/docker-image-refresh.yml

@@ -15,6 +15,9 @@
 name: $(Date:yyyyMMdd)$(Rev:.r)_docker-image-refresh
 
 parameters:
+- name: WindowsPool
+  type: string
+  default: 1es-windows-ps-compute-m
 - name: LinuxPool
   type: string
   default: Azure-Pipelines-1ESPT-ExDShared
@@ -47,10 +50,10 @@ resources:
 extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
   parameters:
-    pool:
-      name: ${{ parameters.LinuxPool }}
-      image: ubuntu-latest
-      os: linux
+    # The 1ES template injects an SDL/compliance stage that MUST run on a Windows pool, so the
+    # template-level pool is Windows. The actual container build overrides to a Linux pool at the
+    # job level below. (Same pattern as sdk-release.yml.)
+    pool: ${{ parameters.WindowsPool }}
     settings:
       networkIsolationPolicy: Permissive
     customBuildTags: