Fix clipped V2 composer picker menus

[Paul Lizer (paullizer)]

Summary

• Fixes composer Agent, Prompt, Model, Reasoning, Approval, and Orchestration model menus being clipped by the mobile Chat tools scroll area. Menus now use viewport-bounded anchored portals while the existing composer layout and scrolling area remain unchanged.
• Preserves selection, clear, keyboard navigation, dismissal, and preference persistence; adds real-component geometry and hit-testing regressions. The regression was verified to fail against the original Dropdown and pass with this fix.

Linked issue

N/A

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Testing / validation

• npm --prefix .\application\v2_ui run build -- --outDir ..\..\ui_tests\artifacts\orchestration-plan-editor and npm --prefix .\application\v2_ui run build - passed (existing Vite large-chunk warning).
• python -m pytest .\ui_tests\test_v2_composer_picker_overlays.py .\ui_tests\test_v2_mobile_chat_layout.py .\ui_tests\test_v2_mobile_navigation.py .\ui_tests\test_v2_mobile_headers.py .\functional_tests\test_v2_composer_picker_placement.py .\functional_tests\test_v2_dropdown_placement.py -q --tb=short - 98 passed.
• python -m pytest .\ui_tests\test_v2_reasoning_controls.py .\ui_tests\test_v2_orchestration_approval_persistence.py .\ui_tests\test_v2_orchestration_model_picker.py .\ui_tests\test_v2_prompt_composer_experience.py -q --tb=short --maxfail=2 - 123 passed.
• python -O .\functional_tests\test_v2_composer_picker_placement.py - passed.
• python .\functional_tests\test_docs_app_surface_coverage.py - 7/7; python .\functional_tests\test_docs_site_quality.py - 6/6; python .\functional_tests\test_v2_ui_local_assets.py - 4/4 passed.
• Added-line XSS checks (5 application files), full-file XSS checks (3 picker files), UI mechanical detector, and git diff --check - passed. Chromium screenshots reviewed; physical iPhone Safari behavior was not tested.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included