Send X-Databricks-Workspace-Id on remaining raw client.Do callers

[Divyansh-db]

Summary

#5368 flipped the workspace routing header from `X-Databricks-Org-Id` to `X-Databricks-Workspace-Id` across five hand-written CLI code paths. Review on that PR identified five more raw `apiClient.Do` call sites that were quietly missing the routing header entirely. On unified hosts with `cfg.WorkspaceID` set, those calls land on the gateway with no routing information and can fail or be misrouted.

Follow-up to #5368 (comment) — splitting the audit work out per the merge-now-audit-after plan.

New call sites covered

All five hit workspace-routed endpoints:

File	Endpoint	Affected command
`bundle/generate/downloader.go`	`GET /api/2.0/workspace/get-status`	`databricks bundle generate`
`cmd/pipelines/utils.go`	`GET /api/2.0/pipelines//events`	`databricks pipelines events`
`libs/databrickscfg/cfgpickers/warehouses.go`	`GET /api/2.0/sql/warehouses`	Interactive warehouse picker (`databricks auth login --configure-cluster`, app prompts)
`libs/apps/prompt/listers.go`	`GET /api/2.0/database/instances//databases`	Lakebase database lister in `databricks apps` prompts
`libs/git/info.go`	`GET /api/2.0/workspace/get-status`	DBR-runtime git info probe used by bundle deploy

Shared helper

Rather than copying the header-building snippet a sixth time, this PR adds a shared helper:

```go
// libs/auth/headers.go
const WorkspaceIDHeader = "X-Databricks-Workspace-Id"

func WorkspaceIDHeaders(cfg *sdkconfig.Config) map[string]string {
if cfg == nil {
return nil
}
wsID := cfg.WorkspaceID
if wsID == "" || wsID == WorkspaceIDNone {
return nil
}
return map[string]string{WorkspaceIDHeader: wsID}
}
```

The helper returns `nil` when the workspace ID is unset or holds the CLI-only `"none"` sentinel, so callers can pass the result directly to `client.Do` without conditional checks.

Cleanup: consolidate the existing copies

The four existing copies of the same pattern are migrated to the helper:

• `cmd/api/api.go` (`workspaceIDHeader` const) → `auth.WorkspaceIDHeader`
• `bundle/deploy/filer.go` (`(s stateFiler) workspaceIDHeaders`) → inline `auth.WorkspaceIDHeaders`
• `libs/filer/files_client.go` (`(w *FilesClient) workspaceIDHeaders`) → inline `auth.WorkspaceIDHeaders`
• `libs/telemetry/logger.go` (`workspaceIDHeaders` package function) → inline `auth.WorkspaceIDHeaders`

`libs/filer/workspace_files_client.go` keeps a thin method wrapper around the shared helper because it has a legitimate nil-`workspaceClient` case in its existing tests; the wrapper handles that nil safety and delegates the rest.

Side effect of consolidation

Callers that previously sent `X-Databricks-Workspace-Id: none` when `cfg.WorkspaceID` was the CLI sentinel `"none"` no longer do — the shared helper treats `"none"` as unset, matching the existing `cmd/api/api.go` normalization and the `auth.ResolveWorkspaceID` helper introduced in #5379. In practice, users who set `workspace_id = none` in `.databrickscfg` are on account-scoped auth and these workspace-routed calls wouldn't succeed regardless, so this is a defensive cleanup, not a behavior regression.

Test plan

• `go test ./libs/auth/... ./libs/filer/... ./libs/telemetry/... ./libs/git/... ./libs/apps/... ./libs/databrickscfg/... ./bundle/deploy/... ./bundle/generate/... ./cmd/api/... ./cmd/pipelines/...` — green
• `go test ./acceptance -run 'TestAccept/cmd/api|TestAccept/telemetry|TestAccept/bundle/user_agent|TestAccept/bundle/generate|TestAccept/pipelines'` — green
• `./task lint-q` — 0 issues; `./task fmt` — clean
• New helper has a focused unit test covering: configured numeric value, configured connection-id-style (UUID) value, empty config, `"none"` sentinel, nil config

[eng-dev-ecosystem-bot]

Commit: 73dfa49

Run: 26763822879