When config.env contains DATABRICKS_AUTH_TYPE=external-browser the
Databricks CLI was ignoring the injected DATABRICKS_TOKEN and falling
back to its own token cache, which fails with 'cache: token not found'.

Introduce build_cmd() helper that centralises credential injection and
overrides DATABRICKS_AUTH_TYPE to 'pat' whenever toolkit has a managed
token to supply (OAuth or PAT). No override applied when no token is
available, preserving any native CLI auth fallback.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>