Add databricks query sql command with read-only safety gate and supporting libraries

[ericfeunekes]

Changes

• Add a new top-level databricks query sql command wired to the Statement
  Execution API with table/JSON/CSV renderers and optional --result-file
  streaming.
• Introduce libs/safety/sqlsafe for policy-based SQL classification plus flag/
  env/profile overrides (profile > env > flag) so destructive SQL is blocked
  unless explicitly enabled.
• Add cmd/query/internal/executor to submit statements, poll completion,
  download external-link chunks, and stream multi-format results—built so
  future subcommands (e.g. query vector-search) can share the plumbing.
• Generate acceptance fixtures for safety overrides, JSON output, async mode,
  etc., to lock down the UX.

Why

Databricks CLI lacked first-class SQL support; this change delivers it while
keeping the surface safe for automation (CI profiles, AI agents). The policy
engine makes it easy to tighten or customize rules later.

Tests

• go test ./cmd/query/... ./libs/safety/sqlsafe
• go test ./libs/cmdio
• Acceptance suites under acceptance/cmd/query/sql/* (basic run, JSON output,
  async, safety override flag/env/profile, etc.)

———

Feel free to adopt/amend as needed.

[github-actions]

An authorized user can trigger integration tests manually by following the instructions below:

Trigger:
go/deco-tests-run/cli

Inputs:

• PR number: 3905
• Commit SHA: bc64b7bba49c73a7511df2bae3f83ac9a05d8f1d

Checks will be approved automatically on success.

[ericfeunekes]

@pkosiec any thoughts on this one? It may not align with what you want to do with querying but it's a really core use case and the safe execution (mainly for AI agents) would be very helpful!