feat(cli)!: remove the residual Go delegation

[Coly010]

What kind of change does this PR introduce?

Feature removal — breaking change.

What is the current behavior?

The CLI still spawns a bundled supabase-go sidecar binary for five deprecated paths via a
GoProxy service: db branch create|delete|list|switch, db remote changes, gen keys,
db diff --use-pg-schema, and the hidden functions download --legacy-bundle flag.

Stacked on #6604 (relocates the Docker image manifest out of the Go tree; no behavior change).

What is the new behavior?

• db branch create|delete|list|switch, db remote changes, and gen keys now fail with exit
  code 1 and a message naming a replacement, instead of proxying to Go:
  • db branch * — local database branches (container-cloning) are removed; see
    supabase branches --help for hosted preview branches, a different product.
  • db remote changes — use supabase db diff --linked.
  • gen keys — use supabase projects api-keys --project-ref <ref> to read a project's API keys.
• db diff --use-pg-schema (deprecated since CLI-1960) is rejected with guidance to use the
  default migra engine or --use-pg-delta, instead of delegating to Go's pg-schema-diff.
• functions download --legacy-bundle (a hidden flag) is tombstoned the same way, pointing at
  --use-api or a redeploy with a current CLI.
• The GoProxy service, its layer, and all wiring in cli/root.ts/shared/cli/run.ts are deleted.
• Every removal is measurable: a new RemovedSurfaceError telemetry fingerprint distinguishes
  command- and flag-removals, so residual usage can be tracked before these stubs are eventually
  deleted outright.

Part of CLI-2432

[github-actions]

🤖 AI Review

The two reviews produced six deduplicated findings. Five are confirmed: --legacy-bundle=false bypasses removal handling, removed surfaces skip the telemetry-state persistence flush, and three naming/comment consistency nits remain. The claimed stale divergence documentation is refuted because that document explicitly identifies itself as a frozen historical ledger.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/commands/functions/download/download.handler.ts:19	correctness	claude+codex	An explicitly supplied --legacy-bundle=false is not rejected, contrary to the command contract, and therefore does not emit removed-flag telemetry.
🟡 MINOR	apps/cli/src/command-internal/removed-command.ts:35	telemetry	codex	The new removed-command and removed-flag failure paths bypass the required TelemetryState.flush persistence step.
⚪ NIT	apps/cli/src/commands/functions/download/download.command.ts:28	consistency	claude	The tombstoned --legacy-bundle flag still has the functional description "Use legacy bundling." rather than describing its removal and replacement.
⚪ NIT	apps/cli/src/shared/functions/download.ts:805	naming	claude+codex	suggestLegacyBundle no longer describes its returned suggestion, which now recommends --use-api and redeployment.
⚪ NIT	apps/cli/scripts/build.ts:292	documentation	claude	A build comment still says the musl package receives supabase-go so GoProxy can find it, although this PR removes GoProxy.

Findings outside the diff

• ⚪ NIT apps/cli/src/commands/functions/download/download.command.ts:28 — The tombstoned --legacy-bundle flag still has the functional description "Use legacy bundling." rather than describing its removal and replacement.
• ⚪ NIT apps/cli/src/shared/functions/download.ts:805 — suggestLegacyBundle no longer describes its returned suggestion, which now recommends --use-api and redeployment.
• ⚪ NIT apps/cli/scripts/build.ts:292 — A build comment still says the musl package receives supabase-go so GoProxy can find it, although this PR removes GoProxy.

Refuted findings (kept for transparency, not posted as review comments)

• apps/cli/docs/go-cli-divergences.md:165 (documentation): The divergences document incorrectly presents db remote changes --password precedence as live behavior after the command became a tombstone.
  Refuted: go-cli-divergences.md:3-9 explicitly labels the entire document a "Frozen historical ledger" retained to answer migration questions and says it is not a current compatibility promise. The cited CLI-1970 history is therefore appropriate in that context.

Stats

Claude findings: 5 · Codex findings: 3 · Confirmed: 5 · Refuted: 1 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.