Phase 2: honor explicit mixed-source Chat selections

[Paul Lizer (paullizer)]

Summary

• Make explicit Chat document selections authoritative regardless of whether the Search Documents panel is open, while retaining hybrid_search as a compatibility/retrieval preference.
• Reuse the Phase 1 authorized manifest, partitions, bounded evidence envelopes, and privacy-safe diagnostics across standard Chat, streaming Chat, local/Foundry model and agent paths, collaboration, retry/edit replay, and workflow Search.
• Route narrative sources through bounded retrieval and tabular sources through the existing native tabular runner with per-source terminal coverage, exact authorized revision/blob identity, tool-citation evidence, and partial-coverage synthesis.
• Add two default-off rollout flags: enable_mixed_source_chat_search for explicit selections and enable_mixed_source_relevance_candidates for the later capped relevance candidate stage.
• Keep Chat/Search relevance-bounded; no exhaustive Analyze, cross-format Compare, persisted follow-up source reuse, or Phase 3-6 behavior is included.
• Add the Cosmos migration scripts and recovery hardening: preserve unusual JSON property names, record nonfatal document skips, and resume bounded HTTP 429 write recovery using durable migration state.
• Bump the combined application release to 0.250.064, with Phase 2 and migration documentation plus release notes.

Security

• Reauthorize personal, group, public, and chat-upload sources at object boundaries; group workflows force their stored authorized group scope.
• Require exact approved shares before source manifests expose shared personal/group documents.
• Keep authorized archived/shared blob locators request-scoped and plugin-validated; never emit them into evidence, prompts, or diagnostics.
• Foundry include_document_context=false now excludes both mixed-source evidence text and file attachments.
• Diagnostics remain aggregate-only and exclude source IDs, filenames, content, paths, prompts, credentials, and raw configuration.

Validation

• 51 passed, 1 skipped across focused mixed-source, workflow, Foundry, migration, and UI collection suites. The UI test skips only when no authenticated SIMPLECHAT_UI_BASE_URL and storage state are configured.
• 1 passed focused Cosmos migration document-skip/reporting test.
• 12 passed route-policy tests.
• Full-file broken-access-control scan passed for 10 files.
• Full-file XSS scan passed for 11 files.
• Python compilation, node --check, editor diagnostics for changed files, and CRLF-aware whitespace checks passed.
• Independent reviews were performed and all substantive findings were repaired.

Scope

Phase 2 only for #1057. The relevance-table candidate stage is explicitly default-off until telemetry confirms coverage and latency. The migration scripts are included as the concurrent 0.250.064 release work.

Fixes#1057
Refs #1055
Refs #1056