Feature/schema ownership

[gabepesco]

Description

SQLMesh creates schemas, views, and tables owned by whichever user/SPN identity executes the plan. The after_all hook is the only existing correction point, but it only fires on successful completion — a failed or partial run leaves objects owned by the executing principal. Two cleanup paths are affected:

• Virtual layer (sushi__dev_alice.*): the janitor drops dev environment schemas on expiry. Unity Catalog rejects the DROP if the janitor doesn't own the schema.
• Physical layer (sqlmesh__sushi.*): the janitor drops orphaned versioned tables after snapshot_ttl (default 1 week). Same ownership problem.

This PR adds an ownership config block that sets owner principals at object-creation time, so even a partially-completed run leaves objects in a manageable state.

Config API:

ownership:
  environment_owner_mapping:
    "^prod$": "svc_prod_spn"
    ".*": "group:shared-developers"
  physical_owner: "group:data-platform"

How it works:

• OwnershipConfig maps environment name regex patterns to owner principals for the virtual layer (first match wins, same style as environment_catalog_mapping), plus a plain physical_owner string for the physical layer.
• Virtual layer: the resolved owner is passed into SnapshotEvaluator.promote() and applied immediately after each CREATE SCHEMA and CREATE OR REPLACE VIEW.
• Physical layer: physical_owner is passed into SnapshotEvaluator.create() and create_physical_schemas(), applied after each physical table and schema is created. ViewKind snapshots are skipped (their ownership is managed by the virtual layer).
• alter_schema_owner(), alter_view_owner(), and alter_table_owner() are no-ops on the base adapter. SparkEngineAdapter (covering Databricks Unity Catalog) issues the corresponding ALTER ... OWNER TO ... DDL with properly backtick-quoted principals, handling names that contain : and @ (Unity Catalog group format).

Test plan:

• Unit tests for OwnershipConfig covering resolve_owner() pattern matching, first-match-wins ordering, case sensitivity, dict deserialization, update_with merge behavior, physical_owner field, and defaults.
• Mocked-adapter tests for SnapshotEvaluator.promote() verifying alter_schema_owner and alter_view_owner are called correctly when owner is set and skipped when omitted.
• Mocked-adapter tests for SnapshotEvaluator.create() and create_physical_schemas() verifying alter_table_owner and alter_schema_owner fire for non-view tables and are suppressed for ViewKind snapshots and when no owner is configured.
• SQL generation tests for SparkEngineAdapter verifying correct backtick-quoted ALTER SCHEMA/VIEW/TABLE ... OWNER TO ... DDL, including principals with : and @. Includes a base adapter no-op test confirming DuckDBEngineAdapter emits no OWNER-related SQL.
• Integration smoke test (@pytest.mark.slow) running a full prod + dev plan/apply cycle with ownership config against DuckDB, verifying no errors and correct schema creation.

Note: the ALTER ... OWNER TO contract on a live Databricks Unity Catalog connection is not tested here — the SQL generation tests verify the correct DDL is produced.

Checklist:

• I have run make style and fixed any issues
• I have added tests for my changes (if applicable)
• All existing tests pass (make fast-test)
• My commits are signed off (git commit -s) per the DCO