Sync from dev @ 726ecd2

Source: main (726ecd2)
Excluded: live tenant exports, generated artifacts, and dev-only tooling.

azure-pipelines-restore.yml

@@ -46,7 +46,7 @@ parameters:
 variables:
   # Tenant-specific values are expected in a variable group (see templates/variables-tenant.yml).
   # Uncomment the line below after creating the group in your Azure DevOps project.
-  # - group: vg-astral-tenant
+  - group: vg-astral-cqre
   - template: templates/variables-common.yml
   - name: BACKUP_FOLDER
     value: tenant-state