fix(core): align Gemini placeholder user turns with ADK Python

[innoprej]

Please ensure you have read the contribution guide before creating a pull request.

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

• Closes: GeminiUtil placeholder user turn ("Continue output. DO NOT look at this line ...") is flagged by prompt injection filters #1628

2. Or, if no issue exists, describe the change:

Problem:

GeminiUtil.ensureModelResponse appends a user turn when a request has no contents or does not end with a user turn. In Java this turn is "Continue output. DO NOT look at this line. ONLY look at the content before this line and system instruction." — an instruction-override style sentence that ADK Python, TypeScript and Go do not use. With Vertex AI and Model Armor prompt injection and jailbreak detection enabled, requests whose only user-role content is this sentence are blocked (piAndJailbreakFilterResult MATCH_FOUND, confidence HIGH), so agents driven only by their instruction cannot run.

Solution:

Use the same wording as ADK Python's BaseLlm._maybe_append_user_content and ADK TypeScript's maybeAppendUserContent:

• no contents: HANDLE_SYSTEM_INSTRUCTION_MESSAGE = "Handle the requests as specified in the System Instruction."
• last turn not from the user: CONTINUE_OUTPUT_MESSAGE = "Continue processing previous requests as instructed. Exit or provide a summary if no more outputs are needed." (same as Go)

CONTINUE_OUTPUT_MESSAGE keeps its name, so existing references still compile; only its text changes. The condition for appending a turn is unchanged.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

./mvnw -pl core test -Dtest=GeminiUtilTest — 32 tests, 0 failures (Microsoft Build of OpenJDK 17.0.19). The expected texts are now string literals that match ADK Python; the four placeholder tests fail on main (they receive the old sentence) and pass with this change. Full ./mvnw -pl core test on Windows 11: 2120 run, 0 failures (24 skipped).

Manual End-to-End (E2E) Tests:

Observed in an application on Vertex AI with Model Armor floor settings: agents that run on their instruction alone were blocked on the first model call while the old sentence was appended. In the same project and settings, the old sentence typed as a plain user message in a new chat session was also blocked by Model Armor, while the new empty-contents sentence ("Handle the requests as specified in the System Instruction.") was not. The patched library itself has not yet been run end-to-end under Model Armor.

Checklist

• I have read the CONTRIBUTING.md document.
• My pull request contains a single commit.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have manually tested my changes end-to-end.
• Any dependent changes have been merged and published in downstream modules.

Additional context

• ADK Python: src/google/adk/models/base_llm.py _maybe_append_user_content
• ADK TypeScript: BaseLlm.maybeAppendUserContent; ADK Go: geminiModel.maybeAppendUserContent (no turn for empty contents)
• Unintended user message injection breaks tool calling with LiteLLM + OpenAI/Azure adk-python#4249 reported the Python empty-contents sentence being flagged by Azure OpenAI's jailbreak filter in the LiteLLM path; Fix unintended user message text that triggers content filters (Closes #4249) adk-python#4315 proposed new wording and was closed in favour of google/adk-python@d0102ec. If maintainers prefer different or configurable text, I am happy to adjust.

[hemasekhar-p]

Hi @innoprej, Thank you for your contribution and for taking the time to submit this pull request. Our team is currently reviewing your changes and we will reach out if we need any further information.