Stop managing retired Ceapex PAT

[missymessa]

Summary

• remove dn-bot-ceapex-package-r from the EngKeyVault Secret Manager manifest
• stop rotating the retired Ceapex packaging PAT now that the audited OneLoc consumers use workload identity federation

The shared OneLoc template's explicit PAT input remains available for compatibility; removal from variable group 103 and EngKeyVault is tracked as operational cleanup.

AB#10151

[Copilot]

Pull request overview

Stops managing (and therefore rotating) the retired Ceapex packaging PAT by removing dn-bot-ceapex-package-r from the EngKeyVault Secret Manager manifest, aligning with the move to workload identity federation for audited OneLoc consumers.

Changes:

• Removed the dn-bot-ceapex-package-r Azure DevOps access token secret definition from the EngKeyVault manifest.
• Eliminated the Secret Manager-managed rotation path for the retired Ceapex packaging PAT.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[missymessa]

Audit found that dn-bot-ceapex-package-r is still in active use, so this PR is blocked and has been converted to draft.

Confirmed evidence:

• DevDiv variable group 343 (OneLocBuildVariables) still contains the PAT and is authorized to multiple enabled pipelines.
• VSUnitTesting-CI build 15108065 and VSUnitTesting-Signed build 15108066 both ran OneLoc successfully today without a federated-token acquisition task. Their current DevDiv template defaults CeapexPat to $(dn-bot-ceapex-package-r) and deliberately selects that path outside the internal project.
• Pythia build 14672695 also succeeded through its PAT-only OneLoc template.
• MachineLearning-Tools-CLI and other DevDiv definitions remain authorized and have recent OneLoc runs without WIF-token tasks; these need individual migration/retirement decisions.
• xcsync build 3057041 used the old PAT-only template on August 25. WIF support flowed to xcsync later that day, but a post-update OneLoc run has not yet validated it.
• The enabled Roslyn Analyzers release/9.0.1xx branch still contains the PAT-only template.
• MAUI's WIF code is merged, but pipeline 13330 is disabled and no representative post-merge OneLoc run was found.

The EngKeyVault secret was rotated on 2026-08-26, remains enabled, expires on 2026-08-29, and is scheduled for another rotation on 2026-08-27. Do not merge this PR or remove the variable-group values until these consumers are migrated or explicitly retired and post-migration runs succeed.