docs(databricks): Unity Catalog comments, product tags and certification in 0.28.0 - #202

Documents what forge-cli 0.28.0 does on Databricks (forge-cli #831 and #835). forge_docs#201 only summarised it in upgrading.md.

docs/providers/databricks.md

• Comments and product tags:
  • Table and column comments come from the contract; a table a dbt build writes keeps dbt's (persist_docs), and fluid validate warns when the contract describes it.
  • The eight product tags: four are the keys AWS Glue and Snowflake already use, four are new. They count toward the 50 tags per securable.
  • fluid_sensitivity column tags, at most 1,000 per table.
• Certification: through system.certification_status. certified comes from the label (case ignored), and deprecated from lifecycle.state, which wins. Any other label value is refused. The ASSIGN permission on that governed tag comes from Databricks' documentation and was not tried with a non-admin identity.
• Refusals: databricks-tag-collision (only for keys the contract states), databricks-tag-value-too-long, databricks-tags-too-many, databricks-comment-unsafe, databricks-certification-invalid.
• #835:
  • the sovereignty refusal panel, captured at width 100;
  • fluid apply --mode dry-run listing superseded function drops;
  • the landing removing its empty volume directories and the local staged copy after a load that finishes, and failing the run when the copy cannot be deleted.
• Live status: the "Not proven live" box now follows HONESTLY_TESTED.md's 2026-11-04 row: what was read back live, and what was not re-run.

docs/advanced/error-codes.md: the databricks-* kinds behind unsupported_binding, with trigger and fix. Three are new in 0.28.0; tag-collision and tags-too-many are older and gained new triggers.

Checks

• Against data-product-forge[databricks]==0.28.0 from PyPI (Python 3.11), all exit 0:
  • check_cli_docs.py
  • check_providers.py
  • check_cli_docs.py --markers-only
  • gen_contract_reference.py --check
  • npm run docs:build
  • check-dist-links.mjs
• A reviewer checked every claim against forge-cli v0.28.0's code and re-ran the quoted output (validate, generate iac, the refusal kind lines, the plan note). Its 7 corrections are applied. No Databricks workspace was available, so the landing clean-up and the dry-run function lines are described from the code.