fix(search): group multi-group fulltext filters before query clause

[SolanCheung]

Summary

Fix #1249 by preserving the intended Lucene precedence when one or more group_id filters are combined with a full-text query.

Current main emits a query shaped like:

group_id:"group1" OR group_id:"group2" OR group_id:"group3" AND (query)

Because AND binds more tightly than OR, the text clause only constrains the final group. This PR groups the full group_id disjunction first:

(group_id:"group1" OR group_id:"group2" OR group_id:"group3") AND (query)

Scope

• One-line production change in the shared non-FalkorDB/non-Kuzu fulltext_query() builder.
• Focused regression coverage for multiple, single, and absent group_id filters.
• No database, MCP, provider, workflow, or unrelated search behavior changes.

Verification

• PR diff is limited to the production fix and focused regression test file.
• Independent review ran the new regression together with tests/utils/search/test_search_security.py: 18 passed.
• Ruff lint and format checks pass on the current PR code.
• CLA is signed and accepted.
• The branch is synchronized with the current upstream main.
• Upstream Tests, Pyright Type Check, and CodeQL Advanced remain action_required for this forked PR, awaiting repository approval to run; this is an approval gate, not a test failure.

Ready for maintainer review.

[zep-cla-assistant]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[SolanCheung]

I have read the CLA Document and I hereby sign the CLA behalf on myself, e-mail: formsg@163.com

[linhongyu510]

The production change has the intended Lucene precedence, and I independently ran the new regression together with tests/utils/search/test_search_security.py: 18 passed. Multi-group, single-group, no-group, and invalid-group-id behavior are all covered.

One scope issue should be removed before merge: .github/workflows/validate-1249.yml is a one-off workflow that only triggers on pushes to validate/1249-group-filter-precedence. It does not validate this fork PR through the upstream pull_request gate, and after merge the upstream repository is not expected to have that branch, so the file becomes dead CI configuration. It also contradicts the PR scope statement that the diff is one production line plus the focused test file. Please drop that workflow from the PR and let the existing repository unit workflow run the tests once the fork approval gate is cleared. The core search fix itself looks correct on this head.

[SolanCheung]

Addressed the review feedback: removed the one-off validate-1249.yml workflow, applied the repository Ruff formatter to the regression test, and synchronized the branch with current main. CLA is accepted and Ruff now passes. The remaining upstream Tests, Pyright Type Check, and CodeQL Advanced runs are still action_required, awaiting repository approval to execute.

[linhongyu510]

Incremental review of the changes since my prior review at b40b2c6: the one-off workflow was removed as requested, the only test change is Ruff formatting, and the upstream merge introduces no change to the production fix. I reran tests/utils/search/test_fulltext_query_group_precedence.py together with tests/utils/search/test_search_security.py: 18 passed. Ruff check and format-check pass for both changed Python files, and git diff --check b40b2c6..ed9483a is clean. No new blocking issue found in the incremental diff. The remaining Tests, Pyright, and CodeQL entries are absent/action-required for this fork head rather than reported failures.