Fix CLI token source --profile fallback with version detection (#751)

## 🥞 Stacked PR
Use this
[link](https://github.com/databricks/databricks-sdk-java/pull/751/files)
to review incremental changes.
-
[**stack/cli-force-refresh**](#751)
[[Files
changed](https://github.com/databricks/databricks-sdk-java/pull/751/files)]
-
[stack/cli-attempt-chain](#752)
[[Files
changed](https://github.com/databricks/databricks-sdk-java/pull/752/files/c4e12c18..5ee21871)]

---------
## Summary

Replace the broken error-based `--profile` fallback in `CliTokenSource`
with version-based CLI detection at init time. Mirrors
[databricks/databricks-sdk-go#1605](databricks/databricks-sdk-go#1605)
and
[databricks/databricks-sdk-py#1377](databricks/databricks-sdk-py#1377).

## Why

`--profile` on `databricks auth token` is a global flag, so old CLIs (<
v0.207.1) **silently accept it** and then fail with `"cannot fetch
credentials"` instead of `"unknown flag: --profile"`. The existing retry
check was matching on the latter and never fired — the `--host` fallback
it gated was effectively dead code. Switching to `databricks version` +
a minimum-version constant makes the fallback reliable and sets up
future capability-gated flags (e.g. `--force-refresh` in
[#752](#752))
without additional subprocess calls.

## What changed

### Interface changes

None. `CliTokenSource` is not part of the public API surface.

### Behavioral changes

- `cfg.profile` + CLI < v0.207.1 now correctly falls back to `--host`
(previously broken).
- `databricks version` failures log a `WARNING` and fall back to the
most conservative command. Successful detections are cached per CLI
path; failures are not cached and will be retried on the next call.
- A default dev build (`v0.0.0-dev`) logs an `INFO` explaining why
feature gates are conservative.

`AzureCliCredentialsProvider` is untouched.

### Internal changes

- New `DatabricksCliVersion` class with a `(major, minor, patch)`
triple, an `UNKNOWN` sentinel, an `atLeast()` comparator, and an
`isDefaultDevBuild()` helper.
- `CliTokenSource` simplified to a single `cmd`; the `fallbackCmd`
parameter and its retry logic are removed.
- `DatabricksCliCredentialsProvider` gains `getCliVersion`,
`probeCliVersion`, `parseCliVersion`, `resolveCliCommand`, and
`buildCliCommand` helpers.

## How is this tested?

Unit tests in `DatabricksCliVersionTest` cover version comparison
(across patch/minor/major), the `UNKNOWN` sentinel, dev-build detection,
and `toString` formatting.

Unit tests in `DatabricksCliCredentialsProviderTest` cover JSON parsing
of `databricks version --output json` (standard, dev build, missing
fields, malformed JSON, empty string) and command assembly for every
profile/host/version combination (host-only, account host, profile + new
CLI, profile + old CLI, unknown version, dev build).

`CliTokenSourceTest` retains its parsing and timezone tests; the
obsolete fallback tests are dropped.

Author: mihaimitrea-db

NEXT_CHANGELOG.md

@@ -7,12 +7,14 @@
 ### Breaking Changes
 
 ### Bug Fixes
+* Fixed Databricks CLI `--profile` fallback by detecting the CLI version at init time. The previous error-based detection was broken because `--profile` is a global Cobra flag silently accepted by old CLIs.
 
 ### Security Vulnerabilities
 
 ### Documentation
 
 ### Internal Changes
+* Detect Databricks CLI version at init time via `databricks version --output json`, enabling version-gated flag support. Successful detections are cached per CLI path; subprocess failures fall back to the most conservative command and are retried on the next call.
 
 ### API Changes
 * Add `createExample()`, `deleteExample()`, `getExample()`, `getPermissionLevels()`, `getPermissions()`, `listExamples()`, `setPermissions()`, `updateExample()` and `updatePermissions()` methods for `workspaceClient.supervisorAgents()` service.

databricks-sdk-java/src/main/java/com/databricks/sdk/core/CliTokenSource.java

@@ -30,11 +30,6 @@ public class CliTokenSource implements TokenSource {
   private String accessTokenField;
   private String expiryField;
   private Environment env;
-  // fallbackCmd is tried when the primary command fails with "unknown flag: --profile",
-  // indicating the CLI is too old to support --profile. Can be removed once support
-  // for CLI versions predating --profile is dropped.
-  // See: https://github.com/databricks/databricks-sdk-go/pull/1497
-  private List<String> fallbackCmd;
 
   /**
    * Internal exception that carries the clean stderr message but exposes full output for checks.
@@ -58,24 +53,11 @@ public CliTokenSource(
       String accessTokenField,
       String expiryField,
       Environment env) {
-    this(cmd, tokenTypeField, accessTokenField, expiryField, env, null);
-  }
-
-  public CliTokenSource(
-      List<String> cmd,
-      String tokenTypeField,
-      String accessTokenField,
-      String expiryField,
-      Environment env,
-      List<String> fallbackCmd) {
-    super();
     this.cmd = OSUtils.get(env).getCliExecutableCommand(cmd);
     this.tokenTypeField = tokenTypeField;
     this.accessTokenField = accessTokenField;
     this.expiryField = expiryField;
     this.env = env;
-    this.fallbackCmd =
-        fallbackCmd != null ? OSUtils.get(env).getCliExecutableCommand(fallbackCmd) : null;
   }
 
   /**
@@ -158,22 +140,6 @@ public Token getToken() {
     try {
       return execCliCommand(this.cmd);
     } catch (IOException e) {
-      String textToCheck =
-          e instanceof CliCommandException
-              ? ((CliCommandException) e).getFullOutput()
-              : e.getMessage();
-      if (fallbackCmd != null
-          && textToCheck != null
-          && textToCheck.contains("unknown flag: --profile")) {
-        LOG.warn(
-            "Databricks CLI does not support --profile flag. Falling back to --host. "
-                + "Please upgrade your CLI to the latest version.");
-        try {
-          return execCliCommand(this.fallbackCmd);
-        } catch (IOException fallbackException) {
-          throw new DatabricksException(fallbackException.getMessage(), fallbackException);
-        }
-      }
       throw new DatabricksException(e.getMessage(), e);
     }
   }