Address review feedback round 2: permissions, lint, direct-only, tests

- Scope govet lint directive to a specific linter (Jannik)
- Remove fabricated InitializeURL; spaces have no stable UI URL yet (Jannik)
- Opt out of terraform via ValidateDirectOnlyResources (Jannik)
- Replace panic in merge_app_spaces with user-facing diagnostic (Denik)
- Add permissions support for app_spaces using the generic
  /api/2.0/permissions/app-spaces/{name} endpoint
- Use print_requests.py helper in acceptance scripts (Denik)
- Add invariant, drift (via invariant no_drift), and bind/unbind
  acceptance tests (Jannik)
- Exclude app_space from migrate invariant test since the resource is
  direct-only (same pattern as catalog, external_location)
- Regenerate annotations, jsonschema, enum_fields, required_fields
- Fix TestConvertLifecycleForAllResources and state_load tests to
  account for the new resource
- Add NEXT_CHANGELOG.md entry

Note: resources.generated.yml needs make generate-direct to populate
output-only fields (create_time, service_principal_*, status, etc.)
from the OpenAPI spec. Until then, invariant no_drift for app_space
will fail locally; CI pipelines with VPN access will keep it in sync.

Co-authored-by: Isaac

Author: bernardo-rodriguez

NEXT_CHANGELOG.md

@@ -19,5 +19,6 @@
 * Support `replace_existing: true` on `postgres_branches` and `postgres_endpoints` so bundles can manage the implicitly-created production branch and primary read-write endpoint of a Lakebase project.
 * Add `postgres_catalogs` resource to bind a Unity Catalog catalog to a Postgres database on a Lakebase Autoscaling branch ([#5265](https://github.com/databricks/cli/pull/5265)).
 * engine/direct: Changes to state file now persisted to .wal file right away instead of being saved in the end ([#5149](https://github.com/databricks/cli/pull/5149))
+* engine/direct: Added support for Databricks App Spaces (`app_spaces` resource type) ([#4982](https://github.com/databricks/cli/pull/4982))
 
 ### Dependency updates

acceptance/bundle/deployment/bind/app_space/databricks.yml.tmpl

@@ -0,0 +1,8 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  app_spaces:
+    foo:
+      name: test-space-$UNIQUE_NAME
+      description: This is a test app space

acceptance/bundle/deployment/bind/app_space/out.test.toml

@@ -0,0 +1,46 @@
+
+>>> [CLI] apps create-space test-space-[UNIQUE_NAME] --description Pre-existing space
+{
+  "name": "test-space-[UNIQUE_NAME]",
+  "description": "Pre-existing space"
+}
+
+>>> [CLI] bundle deployment bind foo test-space-[UNIQUE_NAME] --auto-approve
+Updating deployment state...
+Successfully bound app_space with an id 'test-space-[UNIQUE_NAME]'
+Run 'bundle deploy' to deploy changes to your workspace
+
+=== Deploy bundle
+>>> [CLI] bundle deploy --force-lock --auto-approve
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default/files...
+Deploying resources...
+Updating deployment state...
+Deployment complete!
+
+>>> [CLI] apps get-space test-space-[UNIQUE_NAME]
+{
+  "name": "test-space-[UNIQUE_NAME]",
+  "description": "This is a test app space"
+}
+
+=== Unbind app space
+>>> [CLI] bundle deployment unbind foo
+Updating deployment state...
+
+=== Destroy bundle
+>>> [CLI] bundle destroy --auto-approve
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle-[UNIQUE_NAME]/default
+
+Deleting files...
+Destroy complete!
+
+=== Read the pre-defined app space again (expecting it still exists): 
+>>> [CLI] apps get-space test-space-[UNIQUE_NAME]
+{
+  "name": "test-space-[UNIQUE_NAME]",
+  "description": "This is a test app space"
+}
+
+=== Test cleanup
+>>> [CLI] apps delete-space test-space-[UNIQUE_NAME]
+0

acceptance/bundle/deployment/bind/app_space/output.txt

@@ -0,0 +1,26 @@
+cleanup() {
+    title "Test cleanup"
+    trace $CLI apps delete-space "test-space-$UNIQUE_NAME"
+    echo $?
+}
+trap cleanup EXIT
+
+envsubst < databricks.yml.tmpl > databricks.yml
+
+trace $CLI apps create-space "test-space-$UNIQUE_NAME" --description "Pre-existing space" | jq '{name, description}'
+
+trace $CLI bundle deployment bind foo "test-space-$UNIQUE_NAME" --auto-approve
+
+title "Deploy bundle"
+trace $CLI bundle deploy --force-lock --auto-approve
+
+trace $CLI apps get-space "test-space-$UNIQUE_NAME" | jq '{name, description}'
+
+title "Unbind app space"
+trace $CLI bundle deployment unbind foo
+
+title "Destroy bundle"
+trace $CLI bundle destroy --auto-approve
+
+title "Read the pre-defined app space again (expecting it still exists): "
+trace $CLI apps get-space "test-space-$UNIQUE_NAME" | jq '{name, description}'

acceptance/bundle/deployment/bind/app_space/script

@@ -0,0 +1,10 @@
+Local = true
+Cloud = true
+
+Ignore = [
+    ".databricks",
+    "databricks.yml",
+]
+
+[EnvMatrix]
+  DATABRICKS_BUNDLE_ENGINE = ["direct"]

acceptance/bundle/deployment/bind/app_space/test.toml

@@ -0,0 +1,7 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  app_spaces:
+    foo:
+      name: app-space-$UNIQUE_NAME

acceptance/bundle/invariant/configs/app_space.yml.tmpl

@@ -4,6 +4,7 @@ EnvMatrixExclude.no_vector_search_endpoint = ["INPUT_CONFIG=vector_search_endpoi
 # Error: Catalog resources are only supported with direct deployment mode
 EnvMatrixExclude.no_catalog = ["INPUT_CONFIG=catalog.yml.tmpl"]
 EnvMatrixExclude.no_external_location = ["INPUT_CONFIG=external_location.yml.tmpl"]
+EnvMatrixExclude.no_app_space = ["INPUT_CONFIG=app_space.yml.tmpl"]
 
 # Cross-resource permission references (e.g. ${resources.jobs.job_b.permissions[0].level})
 # don't work in terraform mode: the terraform interpolator converts the path to