[fix] Add explicit auth_type to WorkspaceClient and fix event draining on stream completion

[riley-mete-db]

Summary

• Fix Databricks SDK auth conflicts by adding explicit auth_type to all WorkspaceClient instantiations
• Fix SSE streaming to drain events that arrive between the last poll and stream completion
• Bump claude-agent-sdk to 0.1.20 and update Lakebase instance name for test deployment

What changed

Auth fixes (auth.py, database.py, user.py):

• When both OAuth M2M credentials and a DATABRICKS_TOKEN are present in the environment, the Databricks SDK raises a "more than one authorization method configured" validation error. Adding auth_type="oauth-m2m" (or "pat" for token-based auth) tells the SDK exactly which method to use and prevents it from discovering conflicting credentials.

Cursor and event draining (agent.py, active_stream.py):

• Calling applications (e.g. Lemma) use cursor-based reconnection to resume SSE streams without replaying events. The _cursor timestamp is now included in each event so callers can track their position and pass it back on reconnect. Additionally, events arriving between the last poll and stream completion were being silently dropped — these are now drained before emitting stream.completed.

[calreynolds]

Perfect 👍