Remove public PSGallery in isolated builds to fix CFSClean2 violations

[givinalis]

Summary

Resolves the 3 residual CFSClean2 violations to www.powershellgallery.com observed in the network-isolated 1ES PR/CI builds (e.g. build 172485127, "Stop Network Isolation" step). Follow-up to #1607.

Root cause

All 3 violations are Task name: PowerShell, Process path: C:\Program Files\PowerShell\7\pwsh.exe → www.powershellgallery.com. They are not from the PSScriptAnalyzer@1 task.

Even though every Install-Module / Publish-Module in the build already targets the CFS feed (or the build's local gallery) via -Repository, the default PSGallery repository is still registered on the agent. PowerShellGet contacts it while:

• resolving/refreshing package sources, and
• validating RequiredModules dependencies during Publish-Module (the Microsoft.Graph.* compat modules declare Microsoft.Graph.Authentication as a required module — see build/Publish-LocalCompatModule.ps1).

Those probes are the leak. The build still succeeds because CFSClean2 is currently audit/warn (no blocked connections), but the connections are flagged.

Fix

• Add build/Remove-PublicPSGallery.ps1 — unregisters PSGallery from both PowerShellGet (Unregister-PSRepository) and PSResourceGet (Unregister-PSResourceRepository). Idempotent, and a no-op unless DEPENDENCY_PS_REPO points at a private feed, so local development keeps PSGallery.
• Run it right after NuGetAuthenticate@1 (inside the existing if ne(CfsFeedUrl,'') guard) in both generation templates:
  • .azure-pipelines/generation-templates/generate_adapter-1es.yml (PR + CI)
  • .azure-pipelines/generation-templates/generate_adapter.yml (integration tests)

Repository un-registration persists on the agent for the rest of the job, so every subsequent PowerShell step (installs and publishes) resolves modules exclusively from the feed and the local gallery — leaving no route to the public gallery.

Why this is safe

• Every Install-Module / Publish-Module in build/ already passes an explicit -Repository (feed or local gallery); none rely on an implicit PSGallery.
• Microsoft.Graph.Authentication (the publish-time dependency) resolves from the local gallery (published first for Entra) or the feed, so Publish-Module validation still succeeds without PSGallery.
• The release pipeline (1es-entra-powershell-release.yml) only republishes the prebuilt .nupkg to the public gallery in a release job and does not install modules under isolation, so it is unaffected.

Pipelines covered

• PR: 1es-entra-powershell-pr.yml
• CI: 1es-entra-powershell-ci-build.yml
• Integration: integration-tests.yml

Expected result

CFSClean2 = COMPLIANT (0 violations), matching CFSClean / CFSClean3 / Default Deny.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[learn-build-service-prod]

Learn Build status updates of commit 21a9e69:

❌ Validation status: errors

Please follow instructions here which may help to resolve issue.

File	Status	Preview URL	Details
	❌Error		Details

• Line 0, Column 0: [Error: PSMD2Yaml_FileLoadFailed] Failed to load file: C:/LocalRun/W/lkhb-s/module/mapping/monikerMapping.json. PackageRoot, ReferenceTocUrl, and ConceptualTocUrl are required for every moniker. PackageRoot should be a valid relative path to docset root.

For more details, please refer to the build report.

Note: Your PR may contain errors or warnings or suggestions unrelated to the files you changed. This happens when external dependencies like GitHub alias, Microsoft alias, cross repo links are updated. Please use these instructions to resolve them.