[Expense] Keep approver filters to exact submitter membership

[Prangshuman Das (t-prda)]

Scope

AB#646383

Exact approver-membership layer above #11452 in native stack #11893.

Build filters from exact user values using native SetRange/GetFilter, rather than projecting compressed ranges from approval-setup rows onto a different table. This prevents including an unassigned user between assigned endpoints and preserves literal wildcard/pipe values.

Retain the corrected default-fallback fixture and explicit wildcard, pipe and range-gap regressions. Re-enable only DefaultApproverFilterQuotesWildcardUserNo; the 2000-character error guard remains.

All upstream travel lifecycle permissions, posted-history checks, report-creation postcondition and telemetry changes are preserved. The deletion-only fixture from #11452 remains separate from the upstream lifecycle fixture.

Validation

Exact parent ancestry, file scope, whitespace and exclusion ownership checks pass. This layer's added/removed source lines are unchanged relative to its refreshed parent. Upstream changes are inherited through the main merge, not reverted. The final exact-head cumulative artifact evidence below validates the current implementation; older evidence remains historical. Existing excluded PDF, IN/RU gaps and tolerated-native distinctions remain; no absent/excluded case is claimed passing.

Current checkpoint

Head f438c20e94a417bf477d18293ff84b677541f368, tree 8f1f4641ad458208e8c8a50534da8b0b1de2d789.

Merged main baseline remains 0a602a2481c93ebfe7b1d27d6016fb9926c42111 (permission cleanup from PR 11561). No additional main merge or code changes were made during finalization. Old b195c7a/4eef8ac tree-equality claims remain obsolete after the intentional baseline/auth changes.

Verified AL compile/publish/test run 36162564729 succeeded, attempt 2, at exact validation head da6d82d6c8cf7c64bbd7355ca0acab28f0d5e28a. 113/113 test jobs and 113/113 cleanup steps succeeded. 113/113 credential-removal steps also succeeded.

W1 artifacts verify 11 auth/URL methods + 876 re-enabled API methods + the single CU139496 HTTP scenario, plus 59 owned methods (47 API, 12 Expense), 22 permission methods, 74 SpendRequest methods (9 excluded), and 31 BaseApp methods.

Local Pester at the applicable checkpoint: 106 passed, zero failed/skipped. PowerShell run 36162564206 succeeded, attempt 2. Its earlier analyzer timeout was superseded by the single authorized successful retry; this is not a claim that the timed-out attempt passed.

Validation limits

For uptake/full, CU139496 MicrosoftAuthenticationRespectsServerAuthMode is verified in the actual UserPassword fixture (401/200/401). The Windows 200/200/200 expectations are implemented but Windows runtime remains unverified; no foreign local NST was used. Successful GitHub runs do not establish universal native NAV coverage. Excluded PDF cases, country-specific absent/excluded cases and tolerated-native distinctions are not claimed passing. No PR has been merged or auto-merged; validation drafts remain Do Not Merge outside stack #11893.

[github-actions]

⚠️ Stale Status Check Deleted

The Pull Request Build workflow run for this PR was older than 72 hours and has been deleted.

📋 Why was it deleted?

Status checks that are too old may no longer reflect the current state of the target branch. To ensure this PR is validated against the latest code and passes up-to-date checks, a fresh build is required.

---

🔄 How to trigger a new status check:

1. 📤 Push a new commit to the PR branch, or
2. 🔁 Close and reopen the PR

This will automatically trigger a new Pull Request Build workflow run.

[github-actions]

Issue #11561 is not valid. Please make sure you link an issue that exists, is open and is approved.