Fix installer runfiles for external-owned solib artifacts

rules_pkg 1.3.0 resolves installer sources using their owning repository, but external-owned solib artifacts can have main-repository-relative runfiles paths. Give these files packaging-owned symlink artifacts so the owner and runfiles path agree.

Limit the replacement to installer mappings, leaving ZIP inputs and installed destinations unchanged.

Author: Copilot

misc/bazel/pkg.bzl

@@ -241,6 +241,7 @@ def _codeql_pack_group_extract_options(ctx):
 
 def _codeql_pack_group_extract_files_impl(ctx):
     pkg_files = []
+    installer_sources = {}
 
     platform, apply_pack_prefix, include_all_files = _codeql_pack_group_extract_options(ctx)
     for src in ctx.attr.srcs:
@@ -260,6 +261,15 @@ def _codeql_pack_group_extract_files_impl(ctx):
                 if file_kind == "common" and dest in arch_overrides:
                     file_kind = "arch"
                 if include_all_files or file_kind == ctx.attr.kind:
+                    # External-owned _solib files can live in the main repository's runfiles.
+                    if include_all_files and not file.is_directory and file.owner and file.owner.repo_name and not file.short_path.startswith("../"):
+                        if file not in installer_sources:
+                            source = ctx.actions.declare_file(
+                                "%s-sources/%d/%s" % (ctx.label.name, len(installer_sources), file.basename),
+                            )
+                            ctx.actions.symlink(output = source, target_file = file)
+                            installer_sources[file] = source
+                        file = installer_sources[file]
                     dest_src_map[expanded_dest] = file
 
             if dest_src_map: