The Azure DevOps File Container API rejects every upload-pipeline-artifact PUT with HTTP 400: Content-Range header not understood. because the header is required on all uploads — including single-chunk ones — and ado-aw wasn't sending it.

Summary

• Set Content-Range: bytes 0-{N-1}/{N} on the container PUT in src/safeoutputs/upload_pipeline_artifact.rs (and bytes */0 for zero-byte files, matching the form ADO's own clients send).
• Extracted the formatting into a format_content_range(file_size) helper to keep the upload site readable and unit-testable.

let content_range = format_content_range(file_size); // "bytes 0-11/12", or "bytes */0" if empty

client.put(&upload_url)
    .header("Content-Type", "application/octet-stream")
    .header("Content-Range", &content_range)
    .basic_auth("", Some(token))
    .body(file_bytes)
    .send().await?;

Test plan

• New unit test test_format_content_range covers 0, 1, 12, and 1024-byte payloads.
• cargo test --bin ado-aw upload_pipeline_artifact — all 26 tests pass.