consolidation: align authcheck onto dbxauth.Config (or fold authcheck into dbxauth)

[IceRhymers]

Summary

Follow-up from #218, filed as tracked debt rather than absorbed into it.

After #218, internal/core/authcheck and internal/core/dbxauth sit as siblings in internal/core with opposite conventions for the same tuple:

	shape	CLI resolution
authcheck.IsAuthenticated(profile, cmdName string)	positional (string, string)	via internal/core/cli
dbxauth.NewProvider(Config{Profile, CLIPath})	keyed struct	via internal/core/cli

Both shell out to the Databricks CLI. Both carry the identical (profile, cliPath) pair. Both resolve through the same internal/core/cli. They just disagree on how to take the arguments.

#218 exists to delete exactly this kind of divergence, so leaving a fresh one beside it is the sort of thing that should be tracked, not discovered later.

Why this was NOT absorbed into #218

authcheck has four live non-empty-cmdName consumers (vs token.go's one), which makes it a materially larger and riskier change than the extraction:

• cmd/databricks-claude/setup.go:65
• cmd/databricks-claude/setup.go:84
• cmd/databricks-claude/desktop_config.go:337 (credential-helper path)
• cmd/databricks-claude/serve_install.go:289

Two of those are on surfaces #218 was already being careful around.

Scope

• Either authcheck.IsAuthenticated(dbxauth.Config) / EnsureAuthenticated(dbxauth.Config), or fold authcheck into dbxauth outright (they are the same concern: "talk to the Databricks CLI for this profile").

• Same instrument as consolidation: extract shared token/auth layer into internal/core/dbxauth (+ fix codex/opencode CLI-resolution gap) #218: delete the old symbols so the compiler enumerates the call sites, rather than normalizing positionally where a missed site still builds.

• Also in scope — the process-global MDM reader. cli.SetMDMReader wires a package-level reader that both packages depend on implicitly. Only databricks-claude wires it (main.go, hoisted above every early-exit dispatcher); codex/opencode reach authcheck from five sites without ever wiring one, so they silently get the no-op reader and skip the MDM tier.

  That skip is correct (the MDM domain is claude-branded and only Claude Desktop provisions the key), but the coupling is implicit and the ordering invariant is currently held only by a comment — a future early-exit added above SetMDMReader would silently degrade MDM to the no-op. Making the reader explicit belongs here, in the issue that owns both packages, rather than in either one alone: fixing it in dbxauth only would make it diverge from authcheck, which is the very problem this issue exists to close.

Context

Documented in internal/core/dbxauth/AGENTS.md under "Tracked debt" and "Known asymmetry: the MDM tier is process-global". Part of the epic #196 consolidation family.