[SEA-NodeJS] Pin the kernel by SHA (KERNEL_REV) + kernel-e2e CI

The SEA napi binding is built from the kernel's private Rust source, not a
published/versioned artifact, and the actual `.node` binary is gitignored —
so nothing in the repo records *which* kernel revision the committed
`native/sea/index.d.ts` / `index.js` correspond to, and the standard e2e job
never builds or exercises the binding (its SEA suite skips).

Mirror the databricks-sql-python connector's mechanism:

- `KERNEL_REV` — a single 40-char kernel commit SHA at the repo root: the one
  source of truth for the kernel version the driver is built against. Bumping it
  is the only way to pick up a new kernel, so a driver change and its kernel
  dependency always land together in one bisectable diff. Pinned to current
  kernel main (b4d8822).

- Refresh the committed `native/sea/index.d.ts` / `index.js` to match that SHA.
  main's committed binding had drifted to the pre-#101 surface (missing
  submitStatement / AsyncStatement / params / TLS / metadata methods); this
  regenerates it from the pinned kernel so the committed type contract is
  current and consistent with the pin. Verified main's SEA e2e suite
  (execution / results / interval) passes against the regenerated binding.

- `.github/workflows/kernel-e2e.yml` — reads `KERNEL_REV`, checks the kernel out
  at that SHA via a GitHub App token, builds the napi binding
  (`npm run build:native` against the pinned checkout, cargo via the JFrog
  proxy), asserts the committed binding still matches the pin (drift-guard:
  `git diff --exit-code native/sea/index.*`), and runs the SEA e2e suite against
  the dogfood warehouse. Gate semantics mirror the python workflow:
  synthetic-success on plain PRs, real run in the merge queue (or via the
  `kernel-e2e` label), change-detection to auto-pass when no SEA-relevant files
  moved.

  The test step invokes mocha directly (`npx mocha --config … "tests/e2e/sea/**"`)
  rather than `npm run e2e -- <glob>`: routing a glob through the npm-script's
  inner shell mangles `**` and silently resolves to zero files (a false pass).

- `native/sea/README.md` — documents the pin and how to match it locally.

Requires one-time repo-admin setup (GitHub App allowlist for the kernel repo,
the `kernel-e2e` label, warehouse secrets in azure-prod) — see the workflow
header. Does not change the published-binary story (the
`@databricks/sql-kernel-*` optional packages remain a separate, later step).

Co-authored-by: Isaac
Signed-off-by: Madhavendra Rathore <madhavendra.rathore@databricks.com>

Author: msrathore-db

.github/workflows/kernel-e2e.yml

@@ -280,11 +280,29 @@ jobs:
           DATABRICKS_SQL_KERNEL_REPO: ${{ github.workspace }}/databricks-sql-kernel
         run: npm run build:native
 
+      - name: Assert committed binding matches KERNEL_REV
+        # The committed native/sea/index.d.ts + index.js are the consumer-facing
+        # type contract + platform router; they MUST correspond to the pinned
+        # kernel. build:native just regenerated them from the KERNEL_REV
+        # checkout, so any diff means the committed contract drifted from the
+        # pin — fail loudly and tell the author to commit the regenerated files.
+        # (The .node binaries are gitignored, so git diff only sees the contract.)
+        run: |
+          if ! git diff --exit-code -- native/sea/index.d.ts native/sea/index.js; then
+            echo "::error::native/sea/index.d.ts / index.js are out of sync with KERNEL_REV ($(tr -d '[:space:]' < KERNEL_REV)). Run 'npm run build:native' against that kernel SHA and commit native/sea/index.*."
+            exit 1
+          fi
+          echo "Committed binding matches KERNEL_REV."
+
       - name: Smoke-check binding loads
         run: node -e "const b=require('./native/sea'); if(typeof b.version!=='function'){throw new Error('napi binding failed to load')} console.log('kernel binding ok:', b.version())"
 
       - name: Run SEA e2e tests
-        run: NODE_OPTIONS="--max-old-space-size=4096" npm run e2e -- 'tests/e2e/sea/**/*.test.ts'
+        # Invoke mocha directly rather than via `npm run e2e -- <glob>`: routing a
+        # glob through the npm-script's inner shell mangles `**` and silently
+        # resolves to ZERO files (a false pass). mocha expands the quoted glob
+        # itself, reliably matching every tests/e2e/sea file.
+        run: NODE_OPTIONS="--max-old-space-size=4096" npx mocha --config tests/e2e/.mocharc.js "tests/e2e/sea/**/*.test.ts"
 
       - name: Post Kernel E2E check (success)
         if: success()