Fix validation logic to properly gate bot responses

[Copilot]

The validation step was running security checks but its output wasn't gating bot responses. The job's should_respond output only checked conversation state, allowing the bot to respond to content that failed validation (injection attempts, rate limits, etc.).

Changes:

• Combined validation with state checks: Job output now requires both conversation-state.should_respond AND validation.validation_passed to be true
• Renamed validation output: Changed from should_respond to validation_passed to clarify it's a validation result, not a final decision
• Documented validation scope: Added comments explaining validation applies only to new content (comment body for comment events, issue body for issue events), not historical conversation

Behavior:

# Before: validation results ignored
outputs:
  should_respond: ${{ steps.conversation-state.outputs.should_respond }}

# After: both checks required
outputs:
  should_respond: ${{ (steps.conversation-state.outputs.should_respond == 'true' && steps.validation.outputs.validation_passed == 'true') ? 'true' : 'false' }}

This ensures the bot won't respond if new content fails security validation, while allowing clean comments on issues that had problematic bodies (and vice versa).

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.