The reverse proxy in `libs/testproxy` re-marshalled `apierr.APIError`
into a `{error_code, message}` envelope, dropping `details[]` and any
other fields the workspace returned. As a result, acceptance tests run
against the cloud could not observe error metadata that real CLI/TF
invocations rely on.

This change forwards `apiErr.ResponseWrapper.DebugBytes` verbatim with
the original status code, so callers see exactly what the workspace
sent. As a knock-on fix, response headers in `includeResponseHeaders`
(e.g. `X-Databricks-Org-Id`) are now also passed through on the error
path — previously the `WithResponseHeader` visitors weren't invoked when
`apiClient.Do` returned an error.

`ResponseWrapper` has been populated on every `APIError` since
[databricks-sdk-go#1261](databricks/databricks-sdk-go#1261)
(v0.100.0); the CLI is on v0.132.0. A panic guards the invariant in case
the SDK ever changes shape.

…ricks#5264)

## Summary

Adds support for `replace_existing` on Lakebase `postgres_branches` and
`postgres_endpoints` so users can bring the implicitly-created
production branch and primary read-write endpoint under bundle
management — previously these always returned 409 ALREADY_EXISTS on
deploy.

Also closes the destroy-side gap: the backend signals
lifecycle-owned-by-parent via
`details[].ErrorInfo.metadata.declarative_context: MANAGED_BY_PARENT`.
The Terraform provider already honors this; this PR adds the equivalent
suppression in the direct engine. The acceptance testserver is taught
the same payload shape.

Two focused acceptance tests cover the override-implicit-resource flow
on both engines:

- `postgres_branches/replace_existing`: takes over the production
branch, applies a non-default `no_expiry: true`.
- `postgres_endpoints/replace_existing`: takes over the primary endpoint
of a user-created branch, overrides the project-inherited
`suspend_timeout_duration` (300s → 600s).

## Depends on

Built on top of databricks#5263 (testproxy: forward raw error body and headers
from upstream) — without that fix, the acceptance test proxy strips
`details[]` from upstream errors before they reach the engines, so the
suppression in TF and the direct engine never fires when tests run
against cloud.

## Test plan

- [x] Manually ran both acceptance tests against a real workspace — full
deploy + destroy on both engines.

This pull request and its description were written by Isaac.

…ks#5263)

The reverse proxy in `libs/testproxy` re-marshalled `apierr.APIError`
into a `{error_code, message}` envelope, dropping `details[]` and any
other fields the workspace returned. As a result, acceptance tests run
against the cloud could not observe error metadata that real CLI/TF
invocations rely on.

This change forwards `apiErr.ResponseWrapper.DebugBytes` verbatim with
the original status code, so callers see exactly what the workspace
sent. As a knock-on fix, response headers in `includeResponseHeaders`
(e.g. `X-Databricks-Org-Id`) are now also passed through on the error
path — previously the `WithResponseHeader` visitors weren't invoked when
`apiClient.Do` returned an error.

`ResponseWrapper` has been populated on every `APIError` since
[databricks-sdk-go#1261](databricks/databricks-sdk-go#1261)
(v0.100.0); the CLI is on v0.132.0. A panic guards the invariant in case
the SDK ever changes shape.

…ricks#5264)

## Summary

Adds support for `replace_existing` on Lakebase `postgres_branches` and
`postgres_endpoints` so users can bring the implicitly-created
production branch and primary read-write endpoint under bundle
management — previously these always returned 409 ALREADY_EXISTS on
deploy.

Also closes the destroy-side gap: the backend signals
lifecycle-owned-by-parent via
`details[].ErrorInfo.metadata.declarative_context: MANAGED_BY_PARENT`.
The Terraform provider already honors this; this PR adds the equivalent
suppression in the direct engine. The acceptance testserver is taught
the same payload shape.

Two focused acceptance tests cover the override-implicit-resource flow
on both engines:

- `postgres_branches/replace_existing`: takes over the production
branch, applies a non-default `no_expiry: true`.
- `postgres_endpoints/replace_existing`: takes over the primary endpoint
of a user-created branch, overrides the project-inherited
`suspend_timeout_duration` (300s → 600s).

## Depends on

Built on top of databricks#5263 (testproxy: forward raw error body and headers
from upstream) — without that fix, the acceptance test proxy strips
`details[]` from upstream errors before they reach the engines, so the
suppression in TF and the direct engine never fires when tests run
against cloud.

## Test plan

- [x] Manually ran both acceptance tests against a real workspace — full
deploy + destroy on both engines.

This pull request and its description were written by Isaac.