[Copilot AI] discussion_id not validated before API path interpolation

[nexiouscaliver]

Problem

In _reply_to_discussion (line 784) and _resolve_discussion (line 828), discussion_id is interpolated directly into API URL paths without any format validation:

f"projects/:fullpath/merge_requests/{iid}/discussions/{discussion_id}/notes"

Impact

Malformed IDs (empty string, special characters, extremely long values) produce confusing API errors instead of clear validation failures.

Fix Direction

Add validate_discussion_id() that checks for non-empty hex/alphanumeric format matching GitLab discussion ID patterns.

Acceptance Criteria

• New validate_discussion_id function
• Called in both _reply_to_discussion and _resolve_discussion
• Returns validation_error for invalid IDs
• Tests for empty, special chars, and valid IDs

Identified by Copilot AI agent