Cache /.well-known/databricks-config lookups in the CLI (#5011)

## Why

Every CLI command (`databricks auth profiles`, `bundle validate`, every
workspace or account call) goes through `Config.EnsureResolved`, which
triggers an unauthenticated GET to
`{host}/.well-known/databricks-config` to populate host metadata. That
round trip is ~700ms against production and gets paid on every
invocation, doubling the latency of otherwise single-request commands.

## Changes

**Before:** every CLI invocation hits the well-known endpoint once (or
more when multiple configs get constructed).
**Now:** the first invocation populates a local disk cache under
`~/.cache/databricks/<version>/host-metadata/`; subsequent invocations
read from it. Failures are negatively cached for 60s (except for
`context.Canceled` / `context.DeadlineExceeded`, which are transient and
never cached).

The integration hooks into SDK `v0.128.0`'s
`config.DefaultHostMetadataResolverFactory` (added in
databricks/databricks-sdk-go#1636) via two pieces:

- `libs/hostmetadata/resolver.go`: `init()` registers a factory that
wraps `cfg.DefaultHostMetadataResolver()` in the caching resolver.
`NewResolver(fetch)` remains the unit-testable primary API.
- `main.go`: a blank import of `libs/hostmetadata` triggers that
`init()` at startup, so every `*config.Config` the CLI constructs now
and in the future picks up the cached lookup automatically. No per-site
wiring, no guardrail test.

Positive cache wraps the miss path, so the hit path is a single disk
read; negative cache is only consulted when positive misses.

`internal/testutil/env.go` pins `DATABRICKS_CACHE_DIR` to a temp dir in
test cleanup so tests don't leak cache files into `HOME`.

### Collateral cleanups

- `libs/cache/file_cache.go`: drop the `failed to stat cache file` debug
log when the file is simply missing (`fs.ErrNotExist`). It was pure
noise (the next line, `cache miss, computing`, conveys the same info)
and its OS-specific error text diverged between Unix (`no such file or
directory`) and Windows (`The system cannot find the file specified.`),
breaking cross-platform acceptance goldens. Genuine stat failures
(permission, corruption) still log.
- `libs/testdiff/replacement.go`: `devVersionRegex` now accepts either
`+SHA` or `-SHA` after `0.0.0-dev`. `build.GetSanitizedVersion()` swaps
`+` to `-` for filesystem safety when the version is used in cache
paths, and the old regex only covered the `+` form.

## Test plan

- [x] `make checks` clean
- [x] `make lint` clean (0 issues)
- [x] `go test ./libs/hostmetadata/... -race` clean (factory-installed
assertion + cache hit + fetch error + cancellation-not-cached + host
isolation + end-to-end integration)
- [x] `go test ./cmd/root/... ./bundle/config/... ./cmd/auth/...
./libs/auth/... -race` clean
- [x] End-to-end acceptance test `acceptance/auth/host-metadata-cache/`
asserts exactly ONE `/.well-known/databricks-config` GET across two
`auth profiles` invocations sharing a `DATABRICKS_CACHE_DIR`
- [x] Existing acceptance tests regenerated: fewer well-known GETs in
`out.requests.txt` (caching works), new `[Local Cache]` debug lines in
cache/telemetry tests, two `Warn: Failed to resolve host metadata` lines
removed (intentional: the resolver returns `(nil, nil)` on fetch errors,
which is how the SDK interprets "no metadata available"), stat-not-found
lines removed (see Collateral cleanups)

### Live validation against dogfood (from previous push)

Built locally and ran `databricks -p e2-dogfood current-user me` with
and without a warm cache:

| Scenario | Elapsed well-known time | Cache log output |
|---|---|---|
| Cold cache (fresh `DATABRICKS_CACHE_DIR`) | ~713ms fetch | `cache
miss, computing` -> `GET /.well-known/databricks-config` -> `computed
and stored result` |
| Warm cache (second invocation) | ~1ms | single `[Local Cache] cache
hit` line |

Net per-command savings: ~700ms, matching the Why.

Author: simonfaltum

NEXT_CHANGELOG.md

@@ -5,6 +5,7 @@
 ### CLI
 * Added `--limit` flag to all paginated list commands for client-side result capping ([#4984](https://github.com/databricks/cli/pull/4984)). On `jobs list` and `jobs list-runs` the former API page-size flag was renamed to `--page-size` (hidden) to avoid collision.
 * Accept `yes` in addition to `y` for confirmation prompts, and show `[y/N]` to indicate that no is the default.
+* Cache `/.well-known/databricks-config` lookups under `~/.cache/databricks/<version>/host-metadata/` so repeat CLI invocations against the same host skip the ~700ms discovery round trip.
 * Deprecated `auth env`. The command is hidden from help listings and prints a deprecation warning to stderr; it will be removed in a future release.
 
 ### Bundles

acceptance/auth/bundle_and_profile/output.txt

@@ -13,7 +13,7 @@
 
 === Inside the bundle, profile flag not matching bundle host. Should use profile from the flag and not the bundle.
 >>> errcode [CLI] current-user me -p profile_name
-Warn: Failed to resolve host metadata: (redacted). Falling back to user config.
+Warn: [hostmetadata] failed to fetch host metadata for https://non.existing.subdomain.databricks.com, will skip for 1m0s
 Error: Get "https://non.existing.subdomain.databricks.com/api/2.0/preview/scim/v2/Me": (redacted)
 
 Exit code: 1
@@ -73,7 +73,7 @@ Validation OK!
 
 === Bundle commands load bundle configuration with -t and -p flag, validation not OK (profile host don't match bundle host)
 >>> errcode [CLI] bundle validate -t prod -p DEFAULT
-Warn: Failed to resolve host metadata: (redacted). Falling back to user config.
+Warn: [hostmetadata] failed to fetch host metadata for https://bar.com, will skip for 1m0s
 Error: cannot resolve bundle auth configuration: the host in the profile ([DATABRICKS_TARGET]) doesn’t match the host configured in the bundle (https://bar.com)
 
 Name: test-auth

acceptance/auth/bundle_and_profile/test.toml

@@ -9,10 +9,6 @@ New='DATABRICKS_TARGET'
 Old='DATABRICKS_URL'
 New='DATABRICKS_TARGET'
 
-[[Repls]]
-Old='Warn: Failed to resolve host metadata: .*\. Falling back to user config\.'
-New='Warn: Failed to resolve host metadata: (redacted). Falling back to user config.'
-
 [[Repls]]
 Old='Get "https://non.existing.subdomain.databricks.com/api/2.0/preview/scim/v2/Me": .*'
 New='Get "https://non.existing.subdomain.databricks.com/api/2.0/preview/scim/v2/Me": (redacted)'

acceptance/auth/credentials/unified-host/out.requests.txt

@@ -22,15 +22,6 @@
   "method": "GET",
   "path": "/api/2.0/preview/scim/v2/Me"
 }
-{
-  "headers": {
-    "User-Agent": [
-      "cli/[DEV_VERSION] databricks-sdk-go/[SDK_VERSION] go/[GO_VERSION] os/[OS]"
-    ]
-  },
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
 {
   "headers": {
     "Authorization": [

acceptance/auth/host-metadata-cache/out.test.toml

@@ -0,0 +1,32 @@
+
+=== First invocation populates the cache
+{
+  "profiles": [
+    {
+      "name":"cached",
+      "host":"[DATABRICKS_URL]",
+      "cloud":"aws",
+      "auth_type":"",
+      "valid":false
+    }
+  ]
+}
+
+=== Second invocation should read from the cache
+{
+  "profiles": [
+    {
+      "name":"cached",
+      "host":"[DATABRICKS_URL]",
+      "cloud":"aws",
+      "auth_type":"",
+      "valid":false
+    }
+  ]
+}
+
+=== Only one /.well-known/databricks-config request recorded
+{
+  "method": "GET",
+  "path": "/.well-known/databricks-config"
+}

acceptance/auth/host-metadata-cache/output.txt

@@ -0,0 +1,19 @@
+sethome "./home"
+export DATABRICKS_CACHE_DIR="$TEST_TMP_DIR/cache"
+
+# Point a profile at the mock server so auth profiles triggers a host metadata
+# fetch. Without a profile the command does nothing and the cache is never read.
+cat > "./home/.databrickscfg" <<EOF
+[cached]
+host = ${DATABRICKS_HOST}
+token = test-token
+EOF
+
+title "First invocation populates the cache\n"
+$CLI auth profiles --skip-validate --output json
+
+title "Second invocation should read from the cache\n"
+$CLI auth profiles --skip-validate --output json
+
+title "Only one /.well-known/databricks-config request recorded\n"
+print_requests.py //.well-known/databricks-config --get --sort

acceptance/auth/host-metadata-cache/script

@@ -0,0 +1,5 @@
+Ignore = [
+    "home",
+    "cache",
+]
+RecordRequests = true

acceptance/auth/host-metadata-cache/test.toml

@@ -1,15 +1,7 @@
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
 {
   "method": "GET",
   "path": "/api/2.1/unity-catalog/volumes/main.myschema.myvolume"
 }
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
 {
   "method": "GET",
   "path": "/api/2.1/unity-catalog/volumes/main.myschema.mynewvolume"

acceptance/bundle/resources/volumes/change-schema-name/out.requests.txt

@@ -16,10 +16,6 @@
   "path": "/oidc/v1/token",
   "raw_body": "grant_type=client_credentials\u0026scope=all-apis"
 }
-{
-  "method": "GET",
-  "path": "/.well-known/databricks-config"
-}
 {
   "method": "GET",
   "path": "/oidc/.well-known/oauth-authorization-server"