Bump databricks-sdk-go to v0.136.0 (#5311)

## Why

Pulls in four releases of the Go SDK (v0.133 through v0.136). 

## Changes

**Before:** CLI pinned `databricks-sdk-go` at `v0.132.0` and OpenAPI
spec at SHA `a499dda0`.
**Now:** Pinned at `v0.136.0` / OpenAPI SHA `0555d6a5`.

Most of the diff is regenerated output from `./task generate` (CLI
command stubs, JSON schema, bundle docs, Python bindings, acceptance
goldens). Notable in this batch:

- **New `cmd/workspace/bundle/`** — the auto-generated `databricks
bundle` workspace commands fronting the DMS service (`CreateDeployment`,
`CreateVersion`, `CreateResource`, `CreateOperation`, `Heartbeat`,
`CompleteVersion`, etc.). The interface is currently marked `Deprecated`
in the SDK; this is a generator artifact, not a real deprecation.
- Refreshed pydabs models for new SDK types (`pipelines.Transformer*`,
`pipelines.JsonTransformerOptions`, `pipelines.KafkaOptions`,
`jobs.PythonOperatorTask*`).

Hand-written changes:

- **`CurrentUser.Me` signature:** v0.136 changed it from `Me(ctx)` to
`Me(ctx, iam.MeRequest{})`. Updated 14 production callsites (`cmd/auth`,
`cmd/apps`, `cmd/psql`, `cmd/sync`, `bundle/config/mutator`,
`libs/template`, `libs/sync`, `libs/databrickscfg/cfgpickers`,
`experimental/postgres`,
`experimental/ssh/internal/{client,keys,workspace}`,
`integration/internal/acc`, `acceptance/internal/prepare_server.go`,
`acceptance/dbr_test.go`) plus 3 mocked test expectations in
`cmd/auth/describe_test.go` (`Me(mock.Anything)` -> `Me(mock.Anything,
mock.Anything)`).

<details><summary>SDK v0.132 -> v0.136 changelog summary</summary>

- **v0.133:** WorkspaceAssignmentDetails methods on `a.AccountIamV2` /
`w.WorkspaceIamV2`. `jobs.PythonOperatorTask` on
`RunTask`/`SubmitTask`/`Task`.
`pipelines.ConnectorOptions.KafkaOptions`. Several Postgres / settings
additions. [Breaking] `ml.ListFeaturesRequest` argument order changes;
`postgres.RequestedResource.UnspecifiedResourceName` removed.
- **v0.134:** Jobs `PipelineParams` / `PipelineTask` gained
`FullRefreshSelection`, `RefreshFlowSelection`, `RefreshSelection`,
`ResetCheckpointSelection`. `settingsv2.Setting` gained
`OperationalEmailCustomRecipient` fields.
- **v0.135:** **Added `bundle` package** and `w.Bundle` workspace-level
service. `ml.AuthConfig.MtlsConfig`.
- **v0.136:** Postgres `UndeleteBranch` + branch delete/purge plumbing.
`iam.MeRequest.{Attributes,ExcludedAttributes}` (the `CurrentUser.Me`
signature change). [Breaking] `bundle.Operation.{ActionType,ResourceId}`
and `bundle.Version.CliVersion` made required. [Breaking]
`marketplace.ListListingsRequest.Tags` retyped to `ListingTag`.
[Breaking] `ClustersAPI.Events` pagination shape changed (genkit
absorbed this).

</details>

## Test plan

- [x] `go build ./...`
- [x] `go vet ./...`
- [x] `go test ./internal/build ./bundle/internal/schema
./bundle/direct/dresources ./bundle/config/resources ./libs/template
./bundle/config/mutator`
- [x] `TestConsistentDatabricksSdkVersion` confirms SDK version and
OpenAPI SHA match
- [x] Pydabs codegen tests (8 passed)
- [ ] CI on this PR

---

Replaces #5298 -- moved branch from my fork to upstream so the
JFrog/OIDC token exchange in the test setup works (`id-token: write` is
denied to fork PRs by GitHub Actions).

Author: shreyas-goenka

.codegen/_openapi_sha

@@ -1 +1 @@
-a499dda0f7802e37868d3f3076f62639165475d8
+0555d6a59265799ed8ea12f355eee662e739430d

.gitattributes

@@ -54,6 +54,7 @@ cmd/workspace/apps-settings/apps-settings.go linguist-generated=true
 cmd/workspace/apps/apps.go linguist-generated=true
 cmd/workspace/artifact-allowlists/artifact-allowlists.go linguist-generated=true
 cmd/workspace/automatic-cluster-update/automatic-cluster-update.go linguist-generated=true
+cmd/workspace/bundle/bundle.go linguist-generated=true
 cmd/workspace/catalogs/catalogs.go linguist-generated=true
 cmd/workspace/clean-room-asset-revisions/clean-room-asset-revisions.go linguist-generated=true
 cmd/workspace/clean-room-assets/clean-room-assets.go linguist-generated=true

NEXT_CHANGELOG.md

@@ -10,4 +10,6 @@
 * The error reported when a direct-only resource (catalogs, external locations, vector search endpoints) is used with the terraform engine now also suggests setting `bundle.engine: direct` in `databricks.yml`, in addition to the `DATABRICKS_BUNDLE_ENGINE` environment variable ([#5295](https://github.com/databricks/cli/pull/5295)).
 
 ### Dependency updates
+
 * Bump Go toolchain to 1.26.3 ([#5302](https://github.com/databricks/cli/pull/5302)).
+* Bump `github.com/databricks/databricks-sdk-go` from v0.132.0 to v0.136.0.

acceptance/auth/bundle_and_profile/test.toml

@@ -10,5 +10,5 @@ Old='DATABRICKS_URL'
 New='DATABRICKS_TARGET'
 
 [[Repls]]
-Old='Get "https://non.existing.subdomain.databricks.com/api/2.0/preview/scim/v2/Me": .*'
+Old='Get "https://non.existing.subdomain.databricks.com/api/2.0/preview/scim/v2/Me\??": .*'
 New='Get "https://non.existing.subdomain.databricks.com/api/2.0/preview/scim/v2/Me": (redacted)'

acceptance/auth/bundle_default_profile/test.toml

@@ -7,5 +7,5 @@ Ignore = [
 # Negative case: -p other tries to reach a non-existing host. Redact the
 # OS-/network-dependent suffix so the test is stable across runners.
 [[Repls]]
-Old = 'Get "https://other.test/api/2.0/preview/scim/v2/Me": .*'
+Old = 'Get "https://other.test/api/2.0/preview/scim/v2/Me\??": .*'
 New = 'Get "https://other.test/api/2.0/preview/scim/v2/Me": (redacted)'

acceptance/bundle/refschema/out.fields.txt

@@ -32,7 +32,7 @@ Settings
 Provisioning
   credentials                         These APIs manage credential configurations for this workspace.
   encryption-keys                     These APIs manage encryption key configurations for this workspace (optional).
-  endpoints                           *Beta* These APIs manage endpoint configurations for this account.
+  endpoints                           *Public Preview* These APIs manage endpoint configurations for this account.
   networks                            These APIs manage network configurations for customer-managed VPCs (optional).
   private-access                      These APIs manage private access settings for this account.
   storage                             These APIs manage storage configurations for this workspace.

acceptance/cmd/account/account-help/output.txt

@@ -14,6 +14,7 @@ import (
 	"github.com/databricks/cli/libs/filer"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/service/compute"
+	"github.com/databricks/databricks-sdk-go/service/iam"
 	"github.com/databricks/databricks-sdk-go/service/jobs"
 	"github.com/databricks/databricks-sdk-go/service/workspace"
 	"github.com/google/uuid"
@@ -27,7 +28,7 @@ func workspaceTmpDir(ctx context.Context, t *testing.T) string {
 	w, err := databricks.NewWorkspaceClient()
 	require.NoError(t, err)
 
-	currentUser, err := w.CurrentUser.Me(ctx)
+	currentUser, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
 	require.NoError(t, err)
 
 	timestamp := time.Now().Format("2006-01-02T15:04:05Z")
@@ -79,7 +80,7 @@ func setupDbrTestDir(ctx context.Context, t *testing.T, uniqueID string) (*datab
 	w, err := databricks.NewWorkspaceClient()
 	require.NoError(t, err)
 
-	currentUser, err := w.CurrentUser.Me(ctx)
+	currentUser, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
 	require.NoError(t, err)
 
 	// API path (without /Workspace prefix) for workspace API calls.
@@ -180,7 +181,7 @@ func runDbrTests(ctx context.Context, t *testing.T, w *databricks.WorkspaceClien
 		t.Fatal("CLOUD_ENV is not set. Please run DBR tests from a CI environment with deco env run.")
 	}
 
-	currentUser, err := w.CurrentUser.Me(ctx)
+	currentUser, err := w.CurrentUser.Me(ctx, iam.MeRequest{})
 	require.NoError(t, err)
 
 	// Create debug logs directory

acceptance/dbr_test.go

@@ -36,7 +36,7 @@ Apps
   apps                                   Apps run directly on a customer's Databricks instance, integrate with their data, use and extend Databricks services, and enable users to interact through single sign-on.
 
 Vector Search
-  vector-search-endpoints                **Endpoint**: Represents the compute resources to host vector search indexes.
+  vector-search-endpoints                **Endpoint**: Represents the compute resources to host AI Search indexes.
   vector-search-indexes                  **Index**: An efficient representation of your embedding vectors that supports real-time and efficient approximate nearest neighbor (ANN) search queries.
 
 Identity and Access Management
@@ -92,6 +92,7 @@ Unity Catalog
   tables                                 A table resides in the third layer of Unity Catalog’s three-level namespace.
   temporary-path-credentials             *Public Preview* Temporary Path Credentials refer to short-lived, downscoped credentials used to access external cloud storage locations registered in Databricks.
   temporary-table-credentials            *Public Preview* Temporary Table Credentials refer to short-lived, downscoped credentials used to access cloud storage locations where table data is stored in Databricks.
+  temporary-volume-credentials           *Public Preview* Temporary Volume Credentials refer to short-lived, downscoped credentials used to access cloud storage locations where volume data is stored in Databricks.
   volumes                                Volumes are a Unity Catalog (UC) capability for accessing, storing, governing, organizing and processing files.
   workspace-bindings                     A securable in Databricks can be configured as __OPEN__ or __ISOLATED__.
 

acceptance/help/output.txt

@@ -85,7 +85,7 @@ func PrepareServerAndClient(t *testing.T, config TestConfig, logRequests bool, o
 		w, err := databricks.NewWorkspaceClient()
 		require.NoError(t, err)
 
-		user, err := w.CurrentUser.Me(t.Context())
+		user, err := w.CurrentUser.Me(t.Context(), iam.MeRequest{})
 		require.NoError(t, err, "Failed to get current user")
 
 		cfg := w.Config