acc: run ssh/connect-serverless-cpu locally (#5941)

## Changes
- Flip to `Local = true` / `Cloud = false`. The bare `ssh connect`
(serverless CPU) now runs against the in-process testserver, whose
driver-proxy `/ssh` websocket is backed by a real `sshd` — so the test
asserts both the submitted bootstrap job and a full handshake + remote
exec over the tunnel.
- Linux-only (`[GOOS]`), skipped when `sshd` is absent, matching the
sibling SSH tests.
- Add a `Repls` for `databricks-cpu-<hash>`: with no `--name`, the
connection name is derived from a hash of the workspace host (a random
localhost port locally), so it's normalized to keep the submitted job
payload deterministic.
- Keep the `CLOUD_ENV` branch so the real serverless-CPU path is
preserved for when cloud `ssh connect` is re-enabled.

## Why
`Cloud = false` reflects that cloud `ssh connect` is currently disabled
(#4838); the real coverage now comes from the local run. Consistent with
`connect-serverless-gpu` and `connection`.

Author: radakam

acceptance/ssh/connect-serverless-cpu/known_hosts

@@ -0,0 +1 @@
+# not actually checked by tests; accept-new appends the ephemeral host key here

acceptance/ssh/connect-serverless-cpu/out.test.toml

@@ -0,0 +1,39 @@
+
+=== CLI ssh connect (local sshd)
+
+>>> print_requests.py //api/2.2/jobs/runs/submit
+{
+  "method": "POST",
+  "path": "/api/2.2/jobs/runs/submit",
+  "body": {
+    "environments": [
+      {
+        "environment_key": "ssh_tunnel_serverless",
+        "spec": {
+          "environment_version": "4"
+        }
+      }
+    ],
+    "run_name": "ssh-server-bootstrap-[CPU_CONN]",
+    "tasks": [
+      {
+        "environment_key": "ssh_tunnel_serverless",
+        "notebook_task": {
+          "base_parameters": {
+            "authorizedKeySecretName": "client-public-key",
+            "maxClients": "10",
+            "secretScopeName": "[USERNAME]-[CPU_CONN]-ssh-tunnel-keys",
+            "serverless": "true",
+            "sessionId": "[CPU_CONN]",
+            "shutdownDelay": "10m0s",
+            "version": "[CLI_VERSION]"
+          },
+          "notebook_path": "/Workspace/Users/[USERNAME]/.databricks/ssh-tunnel/[CLI_VERSION]/[CPU_CONN]/ssh-server-bootstrap"
+        },
+        "task_key": "start_ssh_server",
+        "timeout_seconds": 86400
+      }
+    ],
+    "timeout_seconds": 86400
+  }
+}

acceptance/ssh/connect-serverless-cpu/output.txt

@@ -1,6 +1,27 @@
-errcode $CLI ssh connect --releases-dir=$CLI_RELEASES_DIR -- "echo 'Connection successful'" >out.stdout.txt 2>LOG.stderr
+if [ -n "${CLOUD_ENV:-}" ]; then
+  # Cloud: real serverless CPU runs the command; dump the run on failure.
+  title "CLI ssh connect (serverless CPU)\n"
+  errcode $CLI ssh connect --releases-dir=$CLI_RELEASES_DIR -- "echo 'Connection successful'" >out.stdout.txt 2>LOG.stderr
+  if ! grep -q "Connection successful" out.stdout.txt; then
+    run_id=$(cat LOG.stderr | grep -o "Job submitted successfully with run ID: [0-9]*" | grep -o "[0-9]*$")
+    trace $CLI jobs get-run "$run_id" > LOG.job
+  fi
+else
+  # Local: the test server backs the /ssh websocket with a real sshd, so this
+  # asserts the bootstrap job plus a full handshake over the tunnel. Skip when
+  # sshd is absent (only task test-exp-ssh provisions it).
+  if [ -z "$(command -v sshd || ls /usr/sbin/sshd /usr/local/sbin/sshd /sbin/sshd 2>/dev/null)" ]; then
+    echo "SKIP_TEST sshd (openssh-server) not installed"
+    exit 0
+  fi
 
-if ! grep -q "Connection successful" out.stdout.txt; then
-  run_id=$(cat LOG.stderr | grep -o "Job submitted successfully with run ID: [0-9]*" | grep -o "[0-9]*$")
-  trace $CLI jobs get-run "$run_id" > LOG.job
+  # No release artifacts locally and they're never executed; stand in empty archives.
+  mkdir -p releases
+  touch releases/databricks_cli_linux_amd64.zip
+  touch releases/databricks_cli_linux_arm64.zip
+  CLI_RELEASES_DIR="$PWD/releases"
+
+  title "CLI ssh connect (local sshd)\n"
+  errcode $CLI ssh connect --releases-dir=$CLI_RELEASES_DIR --user-known-hosts-file=known_hosts -- "echo 'Connection successful'" >out.stdout.txt 2>LOG.stderr
+  trace print_requests.py //api/2.2/jobs/runs/submit
 fi

acceptance/ssh/connect-serverless-cpu/script

@@ -1,8 +1,28 @@
-Local = false
-Cloud = true
+Local = true
+Cloud = false
 
-# Serverless requires Unity Catalog
+# Serverless requires Unity Catalog.
 RequiresUnityCatalog = true
 
+# Record requests so we can assert the bootstrap job the CLI submits.
+RecordRequests = true
+
+# Stand-in release archives staged by the local run; not golden output.
+Ignore = [
+  "releases",
+]
+
+# The local run drives a real sshd, reliable only on Linux.
+[GOOS]
+  linux = true
+  darwin = false
+  windows = false
+
+# No --name: the connection name is a hash of the (random) local host, so
+# normalize it to keep the submitted job payload deterministic.
+[[Repls]]
+Old = 'databricks-cpu-[0-9a-f]{8}'
+New = "[CPU_CONN]"
+
 [EnvMatrix]
   DATABRICKS_BUNDLE_ENGINE = ["direct"]