feat(appkit): introduce workspace-client wrapper over the Databricks SDK

[MarioCadenas]

What

Introduces packages/appkit/src/workspace-client/ — a facade over the legacy @databricks/sdk-experimental client that mirrors the modular Databricks SDK's multi-client shape. This prepares the library for an incremental, per-service migration to the modular SDK. Nothing is migrated yet — every service still delegates to the legacy client.

Supersedes the exploration in #414, which actually migrated services (files/warehouses/vectorSearch), added upstream patches, and introduced dual-error handling. This PR does only the seam.

Design

• legacy.ts is the only module that imports @databricks/sdk-experimental. It constructs the client and re-exports the SDK symbols AppKit uses (Context, ConfigError, Time, TimeUnits, type namespaces files/jobs/serving/sql, etc.).
• The WorkspaceClient facade exposes per-service accessors (files, warehouses, genie, jobs, statementExecution, servingEndpoints, currentUser, config, apiClient), each legacy-typed and delegating to the underlying client. Migrating a service later is a localized swap: one getter + its accessor type + one connector — the rest of the codebase never touches the SDK.
• createWorkspaceClient() replaces every new WorkspaceClient(...) site (runtime + build-time type-generator). toLegacyWorkspaceClient() is the escape hatch for @databricks/lakebase, which is still on the old SDK.
• createApp({ client }) and the public package index now expose the wrapper type instead of the raw SDK client. (Breaking at the type level for anyone passing a raw SDK client to createApp — no known external users.)
• A Biome noRestrictedImports boundary rule forbids importing @databricks/sdk-experimental outside workspace-client/, so the seam stays enforceable. Tests mock the wrapper rather than the SDK.

Note on Time

Time is sourced off the SDK namespace (SDK.Time ?? SDK.default.Time) rather than a static export { Time }. The SDK's CommonJS Time export is emitted as a getter calling __importDefault(...), which defeats Node's static ESM named-export detection — a direct re-export throws "does not provide an export named 'Time'" at link time. This mirrors the guard the genie connector already used.

Verification

• pnpm build — clean, publint OK
• pnpm -r typecheck — 0 errors, all packages
• Biome boundary rule — 0 violations; @databricks/sdk-experimental imported only in workspace-client/
• pnpm check — 0 errors, 63 warnings (identical to main baseline)
• Full test suite — 3284 passed / 0 failed
• Built playground boots past agent registration + plugin setup (fails only at Databricks auth, as expected without credentials) — confirms the ESM Time fix end-to-end