Skip PAT environment for no-op CI investigations

[nagilson]

Note

Review-only fork PR. nagilson/sdk main already contains the broader pull_request_target experiment from #174, so this draft compares the minimal alternative against the same pre-fix baseline branch.

Scope

Fix the observed post-merge no-op failure without changing the existing pull_request: closed trigger or adding target-branch checkout behavior.

The failed upstream run https://github.com/dotnet/sdk/actions/runs/31824301915 had:

• collect: success
• zero failed-build dossiers
• should_run=false
• pre_activation: failed before runner assignment because the top-level copilot-pat-pool environment was evaluated for the PR-head deployment

Change

• Add on.needs: [collect] so pre_activation and activation wait for deterministic collection.
• Forward collect.should_run through a pre_activation output.
• Resolve the top-level and imported PAT-pool environment to copilot-pat-pool only when should_run=true; no-op runs resolve to no environment.
• Add direct collect dependencies for threat detection and safe outputs so their conditional environment expressions are valid.
• Preserve the existing pull_request: closed trigger.
• Preserve the existing default agent checkout behavior.

Deliberate limitation

This fixes the failure mode actually observed: a no-op merged-PR run becoming red before collection could suppress AI.

It does not make an actionable ordinary pull_request event compatible with the production main-only PAT environment. When should_run=true, PAT-consuming jobs still request copilot-pat-pool, so GitHub may reject the PR-head deployment. Supporting actionable merged-PR investigation outside main remains deferred to the broader trigger/checkout design in #174 or another follow-up.

Validation

• 64 Node tests passed.
• gh aw compile .github/workflows/ci-quality-monitor.md --approve: success, zero warnings.
• git diff --check: clean.
• Generated pat_pool still contains the real token-selection step.
• Generated pre_activation waits for collect and conditionally omits the protected environment for no-op runs.
• Agent, detection, safe outputs, and conclusion retain copilot-pat-pool when should_run=true.

Live no-op validation

Temporarily configured the fork copilot-pat-pool environment to allow only main, matching production, then dispatched this workflow from the non-main copilot/ci-monitor-minimal-preactivation branch with no build ID.

Run: https://github.com/nagilson/sdk/actions/runs/31837528121

• collect: success; 0 failed-build dossiers; should_run=false
• pre_activation: success with a real runner
• pat_pool: success; the job still ran because the shared import has no if. In the fork it selected repository-level COPILOT_PAT_0; no protected-environment deployment was created.
• activation, agent, detection, safe outputs, conclusion: skipped
• overall: success
• exact-SHA deployment query returned no copilot-pat-pool deployments

The fork defines COPILOT_PAT_0 both as a repository secret and an environment secret, so an empty environment does not prevent that repository secret from reaching the job. dotnet/sdk has no repository-level COPILOT_PAT_*; its COPILOT_PAT_1 exists only in copilot-pat-pool, so the production no-op job would run, find no PAT values, warn, and exit successfully. This PR avoids the protected-environment failure but does not skip the pat_pool runner. Skipping the imported job requires a separate backward-compatible condition in shared/pat_pool.md and recompilation of its consumers.

The fork environment was restored to unrestricted after the test.