feat(enclave): add enclave (outpost) management commands

[artem-panchenko]

RATIONALE

Covalent recently shipped a public Outposts API (/covalent/api/v2/outposts). This adds first-class CLI support so operators can register and manage enclaves (outposts) and control who may use them, instead of hand-rolling curl calls. It mirrors the existing dr workload command tree in layout, output handling, and telemetry wiring.

There is no public activate verb — an enclave activates itself when its installer reports in — so no activate command is provided (documented in --help). Manually deactivated enclaves can be returned to service with reactivate.

CHANGES

New feature-gated dr enclave command tree (gated behind DATAROBOT_CLI_FEATURE_ENCLAVE, mirroring dr workload):

• dr enclave register --name <n> [--label k=v] — surfaces the one-shot installation secrets (shown once, never persisted server-side; --output-format json to capture them)
• dr enclave get <id>
• dr enclave list
• dr enclave deactivate <id> — takes an enclave out of service
• dr enclave reactivate <id> — returns a manually deactivated enclave to service (inverse of deactivate)
• dr enclave delete <id> [--yes] — confirmation prompt + friendly 404
• dr enclave access grant <id> --role <owner|user|consumer> <recipient>
• dr enclave access revoke <id> <recipient> — sends the NO_ROLE removal sentinel

access commands wrap the sharedRoles PATCH endpoint, mapping owner|user|consumer → OWNER|USER|CONSUMER, with exactly-one recipient selection (--user / --user-id / --group / --org) enforced via MarkFlagsMutuallyExclusive plus a required-one check. --help calls out the server dependencies (ENCLAVE_RBAC_ENABLED, CAN_SHARE, ENCLAVE_ADMIN_ONLY).

Layout:

• internal/enclave/ — API client (enclave.go), sharing client (sharing.go), output rendering (output.go)
• cmd/enclave/** — parent group + per-verb packages (register, get, list, deactivate, reactivate, del, access/{grant,revoke})
• Registered in cmd/root.go; telemetry-wiring assertions added in cmd/telemetry_wiring_test.go

TESTING

• go build ./..., go vet, gofmt clean
• Unit tests: httptest-backed client (register incl. 409, get + id-escaping, list, deactivate, reactivate, delete + 404, sharedRoles grant/revoke body + path), role/recipient parsing, flag/arg validation, telemetry wiring — all pass
• go test ./cmd/enclave/... ./internal/enclave/... ./cmd/ green

Note: golangci-lint was not run in the authoring environment due to a Go toolchain version gap (repo targets 1.26.5); please rely on CI lint. All wsl/formatting conventions were matched against existing lint-passing packages.

[datarobot-pr-review-router]

👋 Thanks so much for contributing to the DataRobot community!

As a quick heads-up on how our team handles reviews: if you're still iterating on
this code or running tests, please feel free to convert this to a Draft PR.
We rely heavily on GitHub Drafts to give contributors a stress-free sandbox to experiment!

Once everything is finalized and you're ready for feedback, just click "Ready for review"
and the maintainers will be notified to jump in. (And if this PR is already 100% ready
to go, no action needed, we'll take a look soon!)

[ajalon1]

hey @artem-panchenko, thanks!. Have you already talked to @carsongee or @shreyaag-dr about this work? We'd like to see overall what your plans are for the CLI command hierarchy and API, and how they dovetail with the rest of the CLI.

[ajalon1]

Note: golangci-lint was not run in the authoring environment due to a Go toolchain version gap (repo targets 1.26.5).

Were you running into something like this?

compile: version "go1.X.Y" does not match go tool version "go1.X.Z"

If so, https://github.com/datarobot-oss/cli/blob/main/docs/development/building.md#go-version-requirements-for-race-detection