Since deployments are triggered from AzureDevOps rather than being done in Azure, does it follow that everything that is deployable should have an associated pulumi project and some mechanism to determine which branch to deploy to which environment (where environment corresponds to a yml file and to a pink blob in the website) and some mechanism to determine whether that deployment is done automatically or needs manual approval to proceed

yes, but this is a complex problem to solve regardless of pulumi's involvement, it really depends on your org/process