[kartheekp-ms]

Summary

The official builds following #12 selected RejectUntrustedSource because Build.Repository.Provider is unavailable in template expressions and expanded to Null.

• Invoke the shared official stage directly, removing the entire custom guard and rejection job as explicitly approved.
• Preserve the 1ES wrapper, resources, pool, triggers, release parameter default of false, and existing shared-stage parameters.
• Update pipeline documentation to describe official stable opt-in and the external control boundary accurately.

Intentional behavior change

This removes custom YAML enforcement of repository identity, main-only/non-PR sources, and manual-only stable opt-in. Setting DotnetPackageSkillsReleaseBuild=true still selects the existing stable-version path. Required restrictions must be enforced through Azure DevOps branch/permission controls; no such controls were changed or verified here. Reviewed internal mirror sources and authorized signing resources remain operational prerequisites.

Validation

• Available PyYAML parser and focused assertions passed for the exact direct-stage include, unchanged surrounding YAML, public nonofficial defaults, release parameter forwarding, and existing stable/prerelease branches.
• Documentation scope and complete two-file diff reviewed; git diff --check passed.
• No shared stage, public YAML, eng/common, tool code, signing profiles, or SDK pins changed.

Pending hosted acceptance: Azure DevOps template expansion and a successful signed prerelease run after merge/mirroring. The earlier modified-YAML preview was denied EditBuild; that denial was not retried or bypassed. No official/stable build or real signing was run as part of this change.