nebw #3: domains <-> UC governed tags, bidirectional

[larsgeorge-db]

Summary

nebw feature #3: represent Ontos data domains as Databricks Discover governed tags and import them back, bidirectionally.

Grounded in a verified 2026 constraint: Discover Domains are layered on governed tags — there is no public API to create a Discover Domain card and no native "this tag is a domain" flag. So the programmatic contract is the governed-tag key/value convention Discover reads ({domain}, {parent}/{subdomain}); the domain card itself stays a documented manual UI step.

Base is nebw-bugfixes (stacked on PR #735).

Changes

Shared — src/common/governed_tags.py: pure key/value convention, parse, and parent-before-subdomain ordering helpers (fully unit-tested).

Outbound (uc_tag_sync job): when use_governed_domain_tag is set (yaml default on), sync the domain as the databricks_domain governed tag with the Discover convention, replacing the plain ontos_data_domain_name tag. Domain read SQL now joins the parent domain so subdomains emit {parent}/{subdomain}. The convention is inlined in the standalone cluster job and mirrored by the shared module.

Inbound (app-side) — DomainUcSyncManager: parse governed-tag values → create/exists proposals (auto-inserting missing parents, deduped, ordered), open an Asset Review for approval (per decision), and apply an approved import idempotently (parents before subdomains). Routes: POST /data-domains/import-from-uc/{preview,review,apply}.

Fix: create_domain_internal did not stringify a UUID parent_id / caller id for the String PK columns (broke under SQLite) — corrected, consistent with create_domain.

Testing

49 unit tests across the helper, inbound manager, outbound job (stubbed pyspark import), and the domain repository. Broad domain + version suites green, no regressions.

Decisions applied

• Outbound replaces the plain domain tag with the governed-tag convention.
• Inbound is Asset Review-gated before writing.
• Subdomain import auto-creates missing parents.

Follow-ups (documented, not in this PR)

• A UC reader that discovers domain governed-tag values (information_schema / entity tag assignments) to feed the import endpoints (they currently take tag_values in the body).
• Discover Domain card creation (manual UI; no API).

Note

Push used SKIP_SECRET_SCAN=1 for the same pre-existing historical secrets already on main/development (see #735); none are new in this branch.