feat(databricks): one Genie space across deploying identities (parentPath); plan, diff and generate iac show it

AGENTS.md

@@ -356,7 +356,7 @@ example questions in natural language:
 
 ```yaml
 extensions:
-  databricksGenie: {}        # or {title: "Site 360"}
+  databricksGenie: {}        # or {title: "Site 360", parentPath: /genie/asset}
 ```
 
 `fluid apply` creates the space after the tables, masks and row filters, and keeps it in step:
@@ -367,8 +367,19 @@ cases, purpose limitation). The space never widens access. Genie answers as the
 under their Unity Catalog grants. Prompt matching is never turned on. Only the principals with
 `SELECT` get `CAN RUN`. An `agentPolicy` that denies `qa` or `analysis`, or allows neither, refuses the space. The space is
 found again by the marker `[fluid-genie:<product id>]` at the end of its description, only in the
-deploying identity's own folder (one anywhere else is left alone), and removing the block trashes
-it. Code: `fluid_build/iac/providers/databricks_genie.py`.
+deploying identity's own folder or in `parentPath` (one anywhere else is left alone), and removing
+the block trashes a space in the identity's own folder.
+
+A product deployed from more than one identity (a laptop and CI) sets `parentPath`: a workspace
+folder that a workspace admin creates, with `CAN_MANAGE` only for those identities. The space is
+made there and adopted only there, so the identities keep one space. One an earlier apply made
+in the identity's own folder is moved in, keeping its conversations. A space inherits its folder's
+permissions, so the folder is the trust boundary. `/Shared` is refused offline, because every
+workspace user holds `CAN_MANAGE` there. The apply also stops, before `tofu`, on a folder that
+does not exist or one where `users` or `account users` can edit or manage. Removing the block, or
+changing `parentPath`, leaves the space in the old folder with a note naming it. `fluid plan` lists the space as a
+`databricks_genie_space` action, and `fluid generate iac` notes that its module holds none.
+Code: `fluid_build/iac/providers/databricks_genie.py`.
 
 ---
 

CHANGELOG.md

@@ -24,12 +24,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   finds the space by a `[fluid-genie:<product id>]` marker at the end of its description, in the
   deploying identity's own folder only (a space carrying the marker anywhere else is left alone,
   with a note), and updates it with its `etag`. A second apply changes nothing, and removing the
-  block trashes the space. Deploy a product from one identity (CI, say): a space another
-  identity made is left alone, and that identity makes its own.
+  block trashes the space. Deploy a product from one identity (CI, say), or name a shared folder
+  with `parentPath` (below): a space another identity made in its own folder is left alone.
   `fluid apply --mode dry-run` prints what would change. The space is made through the Genie
   REST API (the `[databricks]` extra), since the databricks/databricks provider has no Genie
   space resource. One space per product; a space over several products is a follow-up.
 
+- **One Genie space for a product deployed from more than one identity.**
+  `extensions.databricksGenie.parentPath` names a workspace folder, such as `/genie/<domain>`.
+  A workspace admin creates it and gives `CAN_MANAGE` only to the identities that deploy the
+  product. `fluid apply` creates the space there and adopts only a space directly in that
+  folder, so a laptop and CI keep one space instead of one each. A space an earlier apply made
+  in the identity's own folder is moved in and keeps its conversations. A copy left there
+  afterwards is trashed. A space inherits its folder's permissions, so the folder is the trust
+  boundary. `fluid validate` refuses anything under `/Shared`: every workspace user holds
+  `CAN_MANAGE` there (measured), so each could read every reader's conversations. `fluid apply`
+  stops before `tofu apply` when the folder is missing or not a folder, when its permissions
+  cannot be read, or when a group of every user (`users`, or `account users` under identity
+  federation) holds `CAN_EDIT` or `CAN_MANAGE` on it. Removing the block, or removing or
+  changing `parentPath`, leaves the space in the old folder, with a note naming it: the apply
+  trusts only the folder the contract names now.
+
+- **`fluid plan` lists the Genie space** as a `databricks_genie_space` action with its title,
+  folder, tables and readers. `fluid diff` counts it among the contract's resources and never
+  reports it as drift, since nothing compares it with an apply. **`fluid generate iac` adds a
+  note** that the module it writes holds no Genie space, so a plain `tofu apply` makes none.
+
 - **Databricks: Unity Catalog primary and foreign keys from the contract.** A column tagged
   `primary-key` (all of them, in schema order, for a composite key; each must be
   `required: true`) becomes the table's PRIMARY KEY, and one tagged `foreign-key` with