Python: update ChatKit attachment handling

[SergeyMenshykh]

Motivation & Context

Improve attachment handling consistency in the ChatKit integration sample.

Description & Review Guide

• What are the major changes? Updates request handling and analysis annotations.
• What is the impact of these changes? Attachment lifecycle checks are applied consistently.
• What do you want reviewers to focus on? The updated request flow.

Related Issue

Follow-up to #7038.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Pull request overview

Improves ChatKit attachment lifecycle validation and preview metadata handling.

Changes:

• Validates attachment existence and upload completion before writing.
• Uses stored MIME types for previews and adds CodeQL annotations.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
attachment_store.py	Annotates validated path resolution.
app.py	Adds lifecycle checks and metadata-backed previews.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (4 commit(s)): a428806cb382, 67c7eb083e05, 524c77a7cd3b, 81da60b38274
Model: gpt-5.6-sol

Overview

The PR strengthens attachment handling by validating metadata before upload and preview, preserving path containment checks, and rejecting sequential replay. However, the upload route reads a field that does not exist in the locked ChatKit model, so valid uploads fail before reaching its error handler. Even with the correct field, the separate load/check/write/save sequence does not enforce single completion under concurrency.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (1 high, 1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/samples/05-end-to-end/chatkit-integration/app.py