Fix workspace shared file approval visibility and harden distroless runtime overlay packaging in Dockerfile

[Xeelee33]

Summary

This PR fixes two production-impacting issues:

1. Shared files pending approval in personal/group workspace flows were excluded from approval visibility because the Cosmos DB query only included already approved rows..
2. Docker BuildKit could fail in distroless final-stage overlay copies with cannot copy to non-directory at /usr/lib64 when staging runtime payloads for ODBC and Playwright.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Problem Details

1) Shared approval visibility regression

Pending approval files are intentionally not automatically granted. The scope projection query filtered on granted access only, which hid eligible pending files from approvers.

2) Distroless overlay path conflict

The builder staged runtime trees that could materialize usr/lib64 as a directory, then copied those trees into a distroless base where /usr/lib64 may be a non-directory entry (for example symlink). BuildKit rejects that overlay.

Build error 1:

------
 > [stage-1  8/14] COPY --from=builder /odbc-runtime/ /:
------
Dockerfile:187
--------------------
 187 | >>> COPY --from=builder /odbc-runtime/ /
--------------------
ERROR: failed to build: failed to solve: cannot copy to non-directory: /var/lib/docker/buildkit/containerd-overlayfs/cachemounts/buildkit1492014613/usr/lib64

Build error 2:

 => ERROR [stage-1  9/14] COPY --from=builder /playwright-runtime/ /                                                        9.5s
------
 > [stage-1  9/14] COPY --from=builder /playwright-runtime/ /:
------
Dockerfile:189
--------------------
 189 | >>> COPY --from=builder /playwright-runtime/ /
--------------------
ERROR: failed to build: failed to solve: cannot copy to non-directory: /var/lib/docker/buildkit/containerd-overlayfs/cachemounts/buildkit3127378575/usr/lib64

What Changed

Access index fix

• Updated candidate projection query to include pending approval rows in addition to granted rows.
• Added approval status query parameter for the pending state.

Changed file:

• functions_document_access_index.py
• config.py

Dockerfile/runtime packaging fix

• Kept final runtime overlay copy approach, but staged native libraries under usr/lib for both ODBC and Playwright runtime payloads.
• Continued sourcing native libraries from both /usr/lib64 and /usr/lib in builder stage for compatibility across image layouts.
• This avoids directory-vs-non-directory collisions at /usr/lib64 in distroless images.

Changed files:

• Dockerfile
• config.py

Test alignment and docs

• Updated SQL ODBC runtime regression assertions to match current constant-based defaults.
• Added/updated release notes and fix documentation for both issues.

Changed files:

• test_sql_container_odbc_runtime.py
• test_sql_odbc_driver_18_support.py
• release_notes.md
• index.md
• WORKSPACE_SHARED_FILE_APPROVAL_VISIBILITY_FIX.md
• DISTROLESS_RUNTIME_OVERLAY_PATH_FIX.md

Validation

File sharing bug

File now appears in target workspace with Approve button

Confirmation pop-up appears

And then file is available in target workspace

Dockerfile bug

This command now runs without errors

docker build --no-cache -f .\application\single_app\Dockerfile -t simplechat:dev .

Passed

• test_sql_container_odbc_runtime.py (3/3)
• XSS guardrail check on changed app Python files
• Broken access control guardrail check on changed app Python files
• Diff integrity check (no whitespace/conflict marker issues)

Known failing check

• test_deep_research_chromium_build_opt_out.py currently fails one assertion expecting deployer version 1.0.4 while repo has 1.0.26 (likely stale test expectation, not introduced by this PR’s functional changes).

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included