ci: dispatch the SEA-via-kernel integration leg behind kernel labels + kernel CLOSE_STATEMENT telemetry & auth-rejection sentinel

[mani-mathur-arch]

Context for reviewers

Two changes for the SEA-via-kernel backend (the alternative backend that talks to Databricks SQL through the Rust databricks-sql-kernel static lib over a C ABI, behind the databricks_kernel build tag):

1. CI: extend the databricks-driver-test dispatch so the Go integration suite can run against the SEA-via-kernel backend, selected by label.
2. Kernel backend: record CLOSE_STATEMENT telemetry from kernelRows.Close(), and make the unsupported-authenticator rejection programmatically detectable via the ErrNotSupportedByKernel sentinel.

The two are unrelated in subject but small and both review-driven; they share this PR because the telemetry/sentinel commit was folded onto this branch. Reviewable independently — the CI change touches only .github/workflows/, the kernel change only internal/backend/kernel/ + kernel_config*.go.

Stack position (top of the stack):

#399  OAuth / namespace / metric-view / params / types / query-id   (base)
  └─ #400  richer TLS options
       └─ #401  kernel logging → driver log level
            └─ #402  nightly E2E workflow
                 └─ #403  CI dispatch label + CLOSE_STATEMENT telemetry   ← THIS PR

---

1. CI: kernel integration-test dispatch

Extend the databricks-driver-test dispatch so the Go integration suite can run against the SEA-via-kernel backend, selected by label — the analogue of the existing Thrift labels, not a copy.

Label	Backend	Proxy mode
integration-test	Thrift	replay
integration-test-full	Thrift	passthrough
integration-test-kernel	sea (kernel)	passthrough

• The label resolves both proxy_mode and a new go_mode (thrift vs sea).
• go_mode rides in the repository_dispatch client_payload. The receiver in driver-test reads it to decide whether to build the kernel static lib and run the databricks_kernel-tagged leg. Thrift labels send go_mode: thrift and are unchanged.
• Only one kernel label, and it's passthrough: there are no committed Go-sea proxy recordings yet, so a sea+replay label would have nothing to replay and produce a red, misleading run. A sea replay label can be added later once recordings are captured.
• The new label is added to the on-new-commit label-drop list and the skip-stub guidance.
• The required merge-queue gate stays Thrift-only (go_mode pinned to thrift): the kernel leg is previewable on demand but not a required gate until the SEA backend ships in a released driver.

Two-repo change

This is the driver-side half. The receiver-side half (read go_mode, sea-gated kernel build prerequisites, thread DATABRICKS_GO_MODE, guard sea+replay) is a separate PR in databricks-driver-test. The runner + harness already handle DATABRICKS_GO_MODE=sea end-to-end. On the receiver side the review gate caught (and fixed before merge) two real defects worth knowing about: a backend-aware RECORDING_NAME (databricks-go-${go_mode}) so a sea run can't clobber/serve the committed thrift recordings, and a narrowed git-token insteadOf scope (exact databricks-sql-kernel repo, not the whole databricks/ org) so the kernel App-token isn't applied to unrelated org fetches.

---

2. Kernel backend: CLOSE_STATEMENT telemetry + auth-rejection sentinel

Two review-driven, Go-only fixes on the kernel backend.

CLOSE_STATEMENT telemetry

conn records CLOSE_STATEMENT / close latency / statement success-or-failure only when the rows' OnClose callback fires (the Thrift path fires it). kernelRows.Close() never called it, so kernel queries emitted no close telemetry — including failures — a production observability blind spot.

• Close() now times the teardown and fires OnClose(latencyMs, chunkCount, iterationErr, nil). closeErr is nil because the kernel teardown (C stream/statement close) has no fallible close RPC to report, unlike Thrift's CloseOperation.
• Next() is split into a thin wrapper over next() that records the first non-EOF error as iterationErr (io.EOF is normal drain, not a failure), which Close() passes to the callback — mirroring the Thrift path's iterationErr.
• The callback is armed only after newKernelRows finishes constructing successfully, so the cleanup Close() on a schema-fetch/import failure does not record a falsely-successful CLOSE_STATEMENT (matching the Thrift NewRows, which sets the close callback just before returning).
• Idempotent: the existing closed guard means a double-Close fires OnClose exactly once.

Auth-rejection sentinel

resolveKernelAuth's unsupported-authenticator branch (token-provider / external / federated) returned a bare errors.New, so fallback logic ("kernel can't honor this auth → use Thrift") could only fragile substring-match. It now wraps ErrNotSupportedByKernel via %w so callers can errors.Is it, matching the other kernel-config rejections.

Deliberately not wrapped: the "requires a personal access token" (empty-token) error — that is missing-required-config, not an unsupported feature; wrapping it would wrongly signal "fall back to Thrift" for a forgotten token.

---

Testing

• Workflow YAML validated; label resolution dry-run: integration-test→thrift/replay, integration-test-full→thrift/passthrough, integration-test-kernel→sea/passthrough.
• TestKernelRowsCloseFiresOnClose (tagged): success path (nil errs), iterationErr propagation, idempotent double-close, nil-callbacks-safe, construction-failure-no-success-close.
• TestValidateKernelConfig: strengthened the non-PAT authenticator rejection to assert errors.Is(err, ErrNotSupportedByKernel).
• Default CGO_ENABLED=0 + tagged databricks_kernel: build + vet + test — 24 packages ok, 0 fail each.

Stacking

Stacked on #402 (mani/sea-kernel-nightly-e2e).

This pull request and its description were written by Isaac.

[github-actions]

Go integration tests triggered (sea / passthrough). View workflow runs.

[github-actions]

Go integration tests triggered (sea / passthrough). View workflow runs.

[github-actions]

Integration test approval reset.

New commits were pushed to this PR. Label(s) integration-test-kernel were removed for security.

A maintainer must re-review and re-add a label to preview tests again. (The real gate runs in the merge queue.)

Latest commit: 2b09947