feat: improve duckdb isolation (#10565)

* [ee] feat: improve duckdb isolation

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore: update ee-repo-ref to c4e6cbc1a1efeca5b71920c7903db2347d0eeda0

This commit updates the EE repository reference after PR #713 was merged in windmill-ee-private.

Previous ee-repo-ref: f630f7e73cb863e312430738d81d802a3971f7cd

New ee-repo-ref: c4e6cbc1a1efeca5b71920c7903db2347d0eeda0

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

backend/ee-repo-ref.txt

@@ -1 +1 @@
-c1665a881b61616f96ffe7702b44840905304660
+c4e6cbc1a1efeca5b71920c7903db2347d0eeda0

backend/windmill-worker/src/duckdb_executor.rs

@@ -1597,6 +1597,10 @@ pub async fn do_duckdb(
         )
         .await?;
 
+        #[cfg(feature = "private")]
+        let query_block_list =
+            crate::duckdb_isolation_ee::apply_duckdb_isolation(query_block_list)?;
+
         let base_internal_url = client.base_internal_url.clone();
         let w_id = job.workspace_id.clone();
         let job_dir = job_dir.to_string();

backend/windmill-worker/src/lib.rs

@@ -43,6 +43,8 @@ mod deno_executor;
 mod docker_v2;
 #[cfg(feature = "duckdb")]
 mod duckdb_executor;
+#[cfg(all(feature = "duckdb", feature = "private"))]
+mod duckdb_isolation_ee;
 mod global_cache;
 mod go_executor;
 mod graphql_executor;