feat(databricks): add authenticated workspace client boundary

[ElliotSun]

Summary

Add a small Databricks platform-access boundary that constructs an initialized official WorkspaceClient without moving authentication concerns into the observation domain or reimplementing Databricks authentication policy.

Changes

• add semapact.platforms.databricks.create_databricks_workspace_client(...);
• accept optional workspace_url, token, and profile hints;
• forward only non-empty values to the official WorkspaceClient constructor;
• allow zero explicit hints, delegating to WorkspaceClient() and the Databricks SDK default/unified authentication chain;
• do not hard-code auth_type or impose PAT-specific host/token pairing;
• lazy-load databricks-sdk, keeping base SemaPact independent from the Databricks optional extra;
• keep credential values out of SemaPact logs and serialized domain state;
• leave semapact.observation unchanged: platform operations still consume an already initialized client;
• keep the fresh semapact[databricks] CI smoke offline by validating the official SDK constructor API rather than initializing credentials in CI;
• add isolated unit tests using a fake SDK constructor to lock the pass-through behavior.

Boundary

caller / CLI / standard Databricks config
        ↓
optional hints: workspace_url / token / profile
        ↓
create_databricks_workspace_client(...)
        ↓
WorkspaceClient(**available_hints)
        ↓
Databricks SDK auth resolution
        ↓
platform operations

Examples:

workspace_url + token → explicit hints forwarded to SDK
profile               → Databricks profile forwarded to SDK
no arguments          → WorkspaceClient() default/unified auth

The factory itself does not read environment variables. When explicit hints are omitted, the Databricks SDK may resolve its standard environment/configuration, including Azure/Entra/OAuth/service-principal/managed-identity flows supported by the SDK.

Out of scope

• discovery or observation CLI commands;
• changes to the existing Unity contract importer;
• implementing Databricks authentication providers inside SemaPact;
• credential storage/rotation or secret-manager integration;
• reconciliation or deployment behavior.

Validation

• unit tests verify workspace URL/token/profile are forwarded independently and blank hints are omitted;
• unit tests verify no explicit hints becomes an empty WorkspaceClient(**{}) call;
• regular repository CI exercises importability without requiring Databricks at module import time;
• fresh semapact[databricks] CI installs the real SDK, verifies the WorkspaceClient constructor supports host, token, and profile, and runs both client-boundary and observation tests without making a live Databricks request.