auth: decouple CLI from SDK's Experimental_IsUnifiedHost field (#5047)

## Why

Prep for SDK bump
[databricks/databricks-sdk-go#1641](databricks/databricks-sdk-go#1641),
which removes `Experimental_IsUnifiedHost`, its env var, and the
`UnifiedHost` case in `HostType()`. After the bump the CLI wouldn't
compile.

Rather than stubbing the field and leaving the plumbing behind, this PR
fully drops the flag from the CLI surface now that
`.well-known/databricks-config` discovery is the canonical way to detect
unified hosts.

## Changes

Before: CLI wrote `Experimental_IsUnifiedHost` into every config,
exposed `--experimental-is-unified-host`, read
`experimental_is_unified_host` from `.databrickscfg` profiles, and
honored the `DATABRICKS_EXPERIMENTAL_IS_UNIFIED_HOST` env var.

Now: unified-host routing comes entirely from
`.well-known/databricks-config`. Flag, env var, and profile key read are
all gone. The only surviving mention is a deprecated no-op field on
`Workspace` so existing `databricks.yml` files validate.

Removed:
- `--experimental-is-unified-host` flag (`cmd/auth/auth.go`)
- `AuthArguments.IsUnifiedHost` and the `unifiedHostFallback` parameter
threaded through `HasUnifiedHostSignal` / `IsSPOG` / `ResolveConfigType`
- `legacyUnifiedHostFromProfile()` (`libs/auth/credentials.go`) and its
caller in `error.go`
- `profile.Profile.IsUnifiedHost` and the INI key read in
`FileProfilerImpl.LoadProfiles`
- `profileMetadata.isUnifiedHost` (`cmd/auth/profiles.go`),
`applyUnifiedHostFlags` (`cmd/auth/token.go`)
- `acceptance/auth/credentials/unified-host/` (tested the now-removed
env var; discovery-based unified-host coverage remains in
`TestToOAuthArgument_SPOGHostRoutesToUnified`,
`TestRunHostDiscovery_SPOGHost`, `TestProfileLoadSPOGConfigType`,
`TestLogoutSPOGProfile`, all using mock `.well-known` servers)

Kept:
- `Workspace.ExperimentalIsUnifiedHost` in `bundle/config/workspace.go`
as a deprecated no-op field so existing `databricks.yml` still
validates. Annotation updated.
- Clearing `experimental_is_unified_host` from profiles on OAuth login
and `configure` save, so legacy keys get cleaned up on re-login.

Shared helpers extracted while touching the code:
- `databrickscfg.ExperimentalIsUnifiedHostKey` constant for the
cleanup-only INI key (was 4 string literals)
- `auth.IsClassicAccountHost` helper replacing 3 copies of the
`accounts.` / `accounts-dod.` prefix check

Back-compat:

| Scenario | Behavior |
| --- | --- |
| Profile with `experimental_is_unified_host = true`, reachable
`.well-known/databricks-config` | Still works via discovery. INI key
silently ignored, cleared on next login. |
| Profile with `experimental_is_unified_host = true`, unreachable
`.well-known` | No longer routes as unified. User needs to re-login. |
| `--experimental-is-unified-host` flag | Removed; passing it is an
unknown-flag error. |
| `DATABRICKS_EXPERIMENTAL_IS_UNIFIED_HOST` env var | Not read (was
already being removed by the SDK). |
| New `auth login` against a unified host | Unchanged; routing from
discovery. |
| `databricks.yml` with `experimental_is_unified_host: true` | Silently
ignored, field kept for schema compat. |

## Test plan

- [x] `make checks` clean
- [x] `make lint` 0 issues
- [x] `go test ./libs/auth/... ./cmd/auth/... ./bundle/config/...
./libs/databrickscfg/... ./cmd/configure/...`
- [x] `go test ./acceptance -run
'TestAccept/(cmd/auth|auth|cmd/configure)'`
- [x] `make schema` and `make docs` regenerated; bundle tests green

Author: simonfaltum

NEXT_CHANGELOG.md

@@ -5,6 +5,7 @@
 ### CLI
 
 * Moved file-based OAuth token cache management from the SDK to the CLI. No user-visible change; part of a three-PR sequence that makes the CLI the sole owner of its token cache.
+* Remove the `--experimental-is-unified-host` flag and stop reading `experimental_is_unified_host` from `.databrickscfg` profiles and the `DATABRICKS_EXPERIMENTAL_IS_UNIFIED_HOST` env var. Unified hosts are now detected exclusively from `/.well-known/databricks-config` discovery. The `experimental_is_unified_host` field is retained as a no-op in `databricks.yml` for schema compatibility.
 * Added interactive pagination for list commands that have a row template (jobs, clusters, apps, pipelines, etc.). When stdin, stdout, and stderr are all TTYs, `databricks <resource> list` now streams 50 rows at a time and prompts `[space] more  [enter] all  [q|esc] quit`. ENTER can be interrupted by `q`/`esc`/`Ctrl+C` between pages. Colors and alignment match the existing non-paged output; column widths stay stable across pages. Piped output and `--output json` are unchanged.
 * Added experimental OS-native secure token storage opt-in via `DATABRICKS_AUTH_STORAGE=secure`. Legacy file-backed token storage remains the default.
 

acceptance/auth/credentials/unified-host/out.requests.txt

@@ -46,6 +46,11 @@ type Workspace struct {
 	AzureLoginAppID  string `json:"azure_login_app_id,omitempty"`
 
 	// Unified host specific attributes.
+	//
+	// ExperimentalIsUnifiedHost is a deprecated no-op. Unified hosts are now
+	// detected automatically from /.well-known/databricks-config. The field is
+	// retained so existing databricks.yml files using it still validate against
+	// the bundle schema.
 	ExperimentalIsUnifiedHost bool   `json:"experimental_is_unified_host,omitempty"`
 	AccountID                 string `json:"account_id,omitempty"`
 	WorkspaceID               string `json:"workspace_id,omitempty"`
@@ -135,9 +140,8 @@ func (w *Workspace) Config(ctx context.Context) *config.Config {
 		AzureLoginAppID:  w.AzureLoginAppID,
 
 		// Unified host
-		Experimental_IsUnifiedHost: w.ExperimentalIsUnifiedHost,
-		AccountID:                  w.AccountID,
-		WorkspaceID:                w.WorkspaceID,
+		AccountID:   w.AccountID,
+		WorkspaceID: w.WorkspaceID,
 	}
 
 	for k := range config.ConfigAttributes {