FIX: Enforce bundled native compatibility in Conda packages (#781)

### Work Item / Issue Reference

>
[AB#47315](https://sqlclientdrivers.visualstudio.com/c6d89619-62de-46a0-8b46-70b92a84d85e/_workitems/edit/47315)

### Summary

This pull request introduces significant improvements to the Conda
packaging and validation workflow for `mssql-python`, clarifies the
installation and release process for Conda candidates, and strengthens
platform compatibility and auditing. The most important changes are
grouped below.

**Conda Packaging and Platform Compatibility**

* The Conda recipe now requires `MSSQL_PYTHON_VERSION` to be explicitly
set, preventing accidental builds with the wrong code version. The
combined Conda package now includes both the code and ODBC payload,
eliminating the need for a separate ODBC package as required by pip
installations.
* The Linux `__glibc` dependency is raised to >=2.34 to ensure
compatibility with the full native payload, including the bulk-copy
core.
* On macOS, the build script now explicitly matches `macosx` wheels to
avoid accidentally using Linux wheels in cross-build scenarios.
* For Windows ARM64, the Conda requirements add a `python_abi` pin for
Python 3.12 to ensure ABI compatibility, and the documentation clarifies
that dependencies resolve from the `defaults` channel without automatic
terms acceptance.

**Validation and Auditing Enhancements**

* The Conda build scripts are updated to never silently drop the
bulk-copy core: builds now fail if the required native extension is
missing or incompatible, ensuring no silent reduction in functionality.
* The audit logic now applies PE machine-type validation to both
`win-64` and `win-arm64` packages, and always uses the actual target
subdir for checks.
* The build environment no longer sets or relies on automatic ToS
acceptance for Windows ARM64, and the related environment variable is
removed for clarity and compliance.

**Testing and CI Improvements**

* The CI pipeline now provisions the `testuser` login with `VIEW SERVER
PERFORMANCE STATE` permission, enabling pool eviction tests to observe
physical connections in SQL Server 2022 and 2025 jobs.

**Documentation Updates**

* The main `README.md` and a new `conda/README.md` clarify the temporary
nature of the combined Conda candidate, its installation instructions,
platform requirements, and that these changes do not constitute a public
release or certification.

**Validation Logic Hardening**

* The Python validation logic now includes an additional check to ensure
the required native extension for bulk copy (`mssql_py_core`) is present
and loaded from the correct environment, with improved error messaging
and isolation.

These changes collectively improve the reliability, clarity, and
platform compliance of the Conda packaging and validation process for
`mssql-python`.

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: jahnvi480

OneBranchPipelines/conda-build-pipeline.yml

@@ -1,11 +1,12 @@
 # =========================================================================================
 # OneBranch STANDALONE Conda Build Pipeline (mssql-python)
 # =========================================================================================
-# Builds the SELF-CONTAINED mssql-python conda package (which vendors the ODBC Driver 18
-# payload -- there is NO separate companion package) for every conda subdir, WITHOUT
+# Builds the SELF-CONTAINED mssql-python conda package (binding + ODBC Driver 18 + RS,
+# with NO separate Conda companion packages) for every conda subdir, WITHOUT
 # rebuilding the wheels. It consumes the wheels already produced by the wheel build
-# pipeline (definition 2199): the mssql-python wheels (drop_Consolidate_ConsolidateArtifacts)
-# and the mssql-python-odbc wheels (drop_ConsolidateOdbc_ConsolidateArtifacts), then
+# pipeline (definition 2199): binding wheels plus source-pinned RS wheels/manifests/receipt
+# (drop_Consolidate_ConsolidateArtifacts) and the mssql-python-odbc wheels
+# (drop_ConsolidateOdbc_ConsolidateArtifacts), then
 # repackages + validates them into conda packages on the matching platform agent.
 #
 # WHY PER-OS (not one job for all OSs): unlike the odbc wheels (a pure data re-tag),
@@ -306,7 +307,7 @@ extends:
               ob_outputDirectory: '$(Build.ArtifactStagingDirectory)'
               # The live Encrypt=yes TLS gate is NOT run in the build pipeline: it needs a
               # reachable SQL Server + a secret connection string (release/integration infra),
-              # and the masking-immune static RUNPATH audit (audit_bundled_binaries.py) already
+              # and the masking-immune static RUNPATH audit (eng.conda_tools elf) already
               # guards the OpenSSL layout here. It moves to the release pipeline, where the
               # secret is always present so the gate is unconditional -- no queue-time toggle.
               # The minimal-base ldd reachability gate stays opt-in because it is only VALID on

OneBranchPipelines/jobs/consolidate-artifacts-job.yml

@@ -125,12 +125,16 @@ jobs:
         displayName: 'Consolidate Windows symbols (optional)'
         continueOnError: true
       
-      # Include the companion dependency version for release validation.
+      # Stage the actual RS payload using THIS producer source's immutable pins.
+      # Downstream Conda jobs consume this artifact, never their checkout's NuGet pin.
       - bash: |
           set -e
-          cp $(Build.SourcesDirectory)/eng/versions/mssql-python-rs.version $(ob_outputDirectory)/dist/
-          echo "mssql-python-rs version: $(cat $(ob_outputDirectory)/dist/mssql-python-rs.version)"
-        displayName: 'Include mssql-python-rs version'
+          python3 "$(Build.SourcesDirectory)/eng/scripts/download_mssql_python_rs_wheels.py" \
+            --output-dir "$(ob_outputDirectory)/rs-wheels"
+          cp "$(Build.SourcesDirectory)/eng/versions/mssql-python-rs.version" "$(ob_outputDirectory)/dist/"
+          cp "$(Build.SourcesDirectory)/eng/versions/mssql-python-rs-nuget.version" "$(ob_outputDirectory)/dist/"
+          echo "mssql-python-rs version: $(cat "$(ob_outputDirectory)/dist/mssql-python-rs.version")"
+        displayName: 'Stage source-pinned mssql-python-rs wheels and transport receipt'
       
       # Verify consolidation
       - bash: |

OneBranchPipelines/jobs/consolidate-conda-artifacts-job.yml

@@ -1,7 +1,7 @@
 # Consolidate Conda Artifacts Job Template
-# Collects the per-platform self-contained mssql-python conda packages (which vendor
-# the ODBC payload) that each build leg staged under conda/<subdir>/ and gathers
-# them into a single conda/ tree for the release pipeline to publish.
+# Collects the per-platform combined binding/ODBC/RS packages staged under
+# conda/<subdir>/ and preserves their shared producer RS receipt in the final
+# conda/ tree. Package counts exclude this provenance sidecar.
 #
 # BEST-EFFORT (build pipeline): conda is a downstream repackage of the ESRP-signed
 # wheels and must NEVER block the primary wheel deliverable. An empty set WARNS here;
@@ -22,7 +22,7 @@
 #   TOTAL (PyPI parity minus musllinux)                                      = 28
 # win-arm64 is cross-built for py3.12-3.14 only (py3.10/3.11 have no win-arm64 deps
 # on Anaconda defaults); its runtime import is skipped on the x64 host, so its arch
-# is enforced by the PE-machine assert (assert_pe_machine.py). musllinux (no conda
+# is enforced by the PE audit (eng.conda_tools pe). musllinux (no conda
 # musl subdir) is intentionally NOT conda-built. This job is BEST-EFFORT and never
 # hard-fails on a short set; the release pipeline's conda-release-step enforces the
 # hard gate (required subdirs present + complete Python matrix) before publish.
@@ -92,6 +92,18 @@ jobs:
             found=1
           done < <(find "$(Pipeline.Workspace)/all-artifacts" -type f \( -name 'mssql-python*.conda' -o -name 'mssql-python*.tar.bz2' \))
 
+          receipt="$(ob_outputDirectory)/conda/rs-transport.json"
+          while IFS= read -r source; do
+            if [ -f "$receipt" ]; then
+              cmp -s "$source" "$receipt" || {
+                echo "ERROR: Conda legs disagree on their selected RS transport receipt." >&2
+                exit 1
+              }
+            else
+              cp "$source" "$receipt"
+            fi
+          done < <(find "$(Pipeline.Workspace)/all-artifacts" -type f -name 'rs-transport.json')
+
           echo ""
           echo "Consolidated conda tree:"
           find "$(ob_outputDirectory)/conda" -type f | sort