fix: move Databricks Delta deploy key into secret scope

[anandpant]

Summary

• move the Databricks Delta bundle off raw deploy-key bundle vars and onto a Databricks secret-scope contract
• add a helper that creates or updates the target Databricks secret from local env when available, otherwise validates the existing scope/key
• update the extractor, bundle resources, scripts, and docs so the job resolves the deploy key inside Databricks with dbutils.secrets.get(...)

Verification

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace
• python -m py_compile platform/databricks/delta/extractor/convex_cdc_job.py
• bash -n scripts/ensure-databricks-delta-secret.sh scripts/deploy-databricks-delta.sh scripts/run-databricks-delta-job.sh scripts/run-databricks-delta-smoke.sh
• just --list
• ./scripts/run-databricks-delta-smoke.sh DEFAULT dev 63d28889f3eb3c4b
• databricks bundle summary -p DEFAULT -t dev ... from platform/databricks/delta
• checkpoint verification against workspace.convex_streaming_olap_export_delta_smoke_20260420222132_control.connector_checkpoint_latest
• bronze table verification against workspace.convex_streaming_olap_export_delta_smoke_20260420222132_bronze

---