Re-enable integration test trigger and route cross-org dispatch through emu-access

[mihaimitrea-db]

Summary

• Reverts the intent of Temporarily disable integration test trigger #4899 (temporary stub) and restores automatic integration test triggering. PRs dispatch cli-isolated-pr.yml and pushes to main dispatch cli-isolated-nightly.yml on databricks-eng/eng-dev-ecosystem. The required Integration Tests check is updated by eng-dev-ecosystem's mark-as-* jobs (in_progress → success/failure) instead of being fake-stamped as passed.
• Both upstream blockers are now resolved:
  • eng-dev-ecosystem side: databricks-eng/eng-dev-ecosystem#1252 moved mark-as-pending / mark-as-success / mark-as-failure onto linux-ubuntu-latest-ghec-access runners so cross-org check-run writes no longer 403 on the databricks org allowlist.
  • CLI side (this PR): the cross-org gh workflow run dispatch is moved onto linux-ubuntu-latest-emu-access, following the pattern from Split trigger-tests job and route workflow dispatch through emu-access runner databricks-sdk-go#1638, so it no longer 403s on the databricks-eng org allowlist.
• The job is split in two:
  • integration-trigger (deco runners) handles same-org Integration Tests check writes for the PR-skip and merge-group-auto-approve paths, using the DECO_TEST_APPROVAL app token. Testmask-based gating and the pre-Temporarily disable integration test trigger #4899 summaries (Skipped (changes do not require integration tests) / Auto-approved for merge queue (tests already passed on PR)) are restored.
  • trigger-tests (emu-access runners) mints the DECO_WORKFLOW_TRIGGER token and issues the cross-org gh workflow run cli-isolated-pr.yml / cli-isolated-nightly.yml dispatches.
• integration-trigger-dependabot is unchanged.

NO_CHANGELOG=true

Test plan

• On this PR, confirm integration-trigger runs on databricks-deco-testing-runner-group and succeeds.
• Confirm trigger-tests runs on databricks-release-runner-group-emu-access; Generate GitHub App Token step succeeds (no 403); Trigger integration tests (pull request) dispatches cli-isolated-pr.yml on databricks-eng/eng-dev-ecosystem with pull_request_number and commit_sha inputs.
• On databricks-eng/eng-dev-ecosystem, confirm the dispatched cli-isolated-pr run appears (event: workflow_dispatch) and its checkout job uploads the update-check-action and gh-report-action artifacts.
• Confirm mark-as-pending runs on linux-ubuntu-latest-ghec-access and updates the Integration Tests check on the PR commit to in_progress.
• When the integration-tests-prod matrix finishes, confirm mark-as-success / mark-as-failure updates the check to success / failure. (Known separate issue: integration-tests-prod on main has been failing due to a Go 1.25.9 toolchain fetch against proxy.golang.org; that is out of scope here.)
• Merge-queue path: after ready-for-merge, confirm integration-trigger writes the Auto-approved for merge queue (tests already passed on PR) check.
• Push-to-main path: after merge, confirm a workflow_dispatch run of cli-isolated-nightly.yml appears on eng-dev-ecosystem keyed to the merge commit SHA.

This pull request and its description were written by Isaac.

[github-actions]

Waiting for approval

Based on git history, these people are best suited to review:

• @pietern -- recent work in .github/workflows/

Eligible reviewers: @andrewnester, @anton-107, @denik, @renaudhartert-db, @shreyas-goenka, @simonfaltum

_{Suggestions based on git history. See OWNERS for ownership rules.}