AIGTWY-4878 Forward external Databricks auth to Codex MCP proxies

[tt-le]

Summary

Standalone production prerequisite for the MCP CUJ in #990. Targets main and contains only the Codex stdio MCP entry change and its regressions.

• Add DATABRICKS_BEARER and DATABRICKS_BEARER_COMMAND to the env_vars forwarded to UG-managed Codex MCP proxies.
• Persist variable names only, never bearer values or credential-command values.
• Cover both user- and machine-managed entry generation.

Scenario

An isolated CI session or external credential broker supplies a bearer (or token-producing command) instead of a cached Databricks user OAuth profile. The ug mcp-proxy subprocess needs that external auth to connect. Explicit forwarding prevents it from losing the auth override and falling back to an unavailable profile/cache. Native HTTP OAuth MCP entries are unchanged.

Validation

• 155 Codex component/regression tests passed on this branch against main.
• Ruff lint/format and git diff --check passed.
• No new live SP-authenticated TUI/inference pass.

The production change and its regression tests have been removed from #990, which remains the test-only consumer. Merge this prerequisite before expecting its external-auth Codex MCP journey to pass.

---

This PR was created with GitHub MCP.

[github-actions]

UG review

Reviewed external-auth environment forwarding for Codex stdio MCP proxies and user-/machine-managed configuration coverage. The change stores variable names rather than credential values and leaves HTTP MCP entries unchanged.

No actionable findings.

Automated advisory review of fc0f4f0c268b using Lilly's UG review rubric. It does not approve or block this PR.