* chore: release engine-v1.14.0 + dagster-v1.10.0 + vscode-v1.6.4

Bumps all three artifacts to cover the 16-PR cascade since engine-v1.13.0
/ dagster-v1.9.0 / vscode-v1.6.3. Details in each CHANGELOG.

Engine headlines (12 PRs):
- Arc 7 wave 2 wave-2 complete — cached DESCRIBE end-to-end
  (#223 infra, #228 reads, #230 write tap, #231 discover warm-up,
  #232 state controls + --cache-ttl override)
- Arc 2 wave 3 complete — bytes_scanned / bytes_written on
  MaterializationOutput (#219 BQ, #221 Databricks, #220 Snowflake
  deferred doc, #222 docstring cascade). Real $ on rocky cost for
  BQ + Databricks
- FR-005 Unity Catalog workspace-binding reconcile (#226)
- FR-002 Fivetran connector metadata via SourceOutput.metadata (#225)
- Housekeeping: compute_backoff dedup into rocky_core::retry (#217)

Dagster headlines (4 PRs):
- FR-001 RockyComponent Pipes execution mode + FR-006 strict doctor
  on RockyResource startup (#224)
- FR-003 RockyResource.state_health() (#227) + FR follow-up threading
  doctor(check=state_rw) for sub-second probes (#229)
- RockyResource.cost() wiring + fixture (#218)

VS Code: regenerated TS bindings for engine 1.14.0 type additions.
No extension feature changes.

* chore(integrations/dagster): regenerate test fixtures for engine 1.14.0

36 fixtures picked up the new engine version string in their top-level
"version" field. No schema changes — just the version bump.

* feat(engine/rocky-core): classification + masking trait + config plumbing

Wave A Agent 1 foundation for column classification + masking policies.

GovernanceAdapter trait gains two methods:
  - apply_column_tags(table, column_tags) — per-column tagging; default
    errors so adapters declare support explicitly (Databricks YES, others
    surface the gap). NoopGovernanceAdapter overrides to Ok(()) so
    pipelines that declare classifications against no-governance
    warehouses degrade gracefully.
  - apply_masking_policy(table, policy, env) — env-aware masking policy
    application. Same default-errors-must-override contract.

Types added:
  - MaskStrategy (Hash | Redact | Partial | None) — wire shape matching
    the rocky.toml TOML (rename_all = "lowercase"). Derives JsonSchema.
  - MaskingPolicy { column_strategies } — per-column resolved strategy
    map. The config→adapter bridge resolves classification tags against
    [mask] / [mask.<env>] and emits this.

Config surface (rocky.toml):
  - [mask] holds workspace-default strategies keyed by classification
    tag (pii = "hash"). [mask.<env>] overrides per environment. Parsed
    via an untagged MaskEntry enum so serde tries scalar first, falls
    through to nested-table shape. Unknown strategies hard-fail at load.
  - [classifications].allow_unmasked — advisory list for suppressing
    the upcoming W004 warning when a classification has no matching
    strategy (e.g., internal-only discovery tags).
  - RockyConfig::resolve_mask_for_env(env) — single entry point the
    run/plan layers will call to produce the flat tag→strategy map.

Model sidecar ([classification] block):
  - ModelConfig / RawModelConfig gain classification: BTreeMap<String,
    String>. Keys are column names, values are free-form classification
    tags so teams can coin new ones without touching the engine.

SQL generation scaffolding (Databricks-flavored, rocky-core):
  - catalog::generate_set_column_tags_sql — ALTER TABLE ... ALTER COLUMN
    ... SET TAGS for per-column Unity Catalog tagging.
  - new masking module — generate_create_mask_sql (CREATE OR REPLACE
    FUNCTION with sha2/redact/partial bodies), generate_set_mask_sql
    (ALTER TABLE ... SET MASK), generate_drop_mask_sql. Function names
    namespaced by env: rocky_mask_<strategy>_<env>.

Deferrals noted for follow-up commits:
  - The SDK-trait (rocky-adapter-sdk) copy of GovernanceAdapter has
    long lagged rocky-core's (it's missing the 4 workspace methods from
    #226). Not backported here — that drift predates this PR and is out
    of scope.
  - CLI --env flag threading into run.rs: the resolver already takes
    Option<&str>, but no callsite surfaces env yet. Lands in a follow-up
    once the full run/plan pass is wired.

Tests: trait defaults + Noop overrides (rocky-core/src/traits.rs), SQL
generation (catalog.rs + masking.rs), config parsing + env-override
resolution (config.rs), sidecar classification parsing (models.rs).

* feat(engine/rocky-databricks): implement apply_column_tags + apply_masking_policy

Completes the Databricks half of the Wave A Agent 1 foundation. Unity
Catalog column tags are applied one statement per column (UC rejects
multi-column ALTER COLUMN in one DDL). Masking policies are applied in
two passes: CREATE OR REPLACE the backing functions per distinct
strategy/env, then ALTER TABLE ... ALTER COLUMN SET MASK (or DROP MASK
when the resolved strategy is None).

rocky-core::traits: MaskStrategy gains PartialOrd + Ord so BTreeSet can
dedupe strategy applications in apply_masking_policy.

rocky-databricks::catalog: new CatalogManager::set_column_tags helper
skipping empty tag maps (UC rejects SET TAGS ()).

rocky-databricks::governance: GovernanceAdapter impl for
DatabricksGovernanceAdapter gains both new methods. Pass 1 uses the
generate_create_mask_sql helper from rocky-core::masking with env-
namespaced function names (rocky_mask_<strategy>_<env>) for
idempotency. Pass 2 threads column→strategy through
generate_set_mask_sql / generate_drop_mask_sql. DROP is only emitted
when an explicit None overrides a prior masked tag; this keeps us
clear of Databricks' missing DROP MASK IF EXISTS form.

* feat(engine/rocky-cli): wire column classification + masking reconcile in rocky run

Hooks the two new GovernanceAdapter methods from the classification +
masking foundation into the happy path of `rocky run`. After the model
DAG executes successfully, the main pipeline path now:

  1. Reloads the project's `rocky_compiler::Project` (cheap re-walk of
     `models_dir/`) to access each model's `[classification]` sidecar.
  2. For every model with a non-empty classification map, builds a
     column → {"classification": tag} map and calls
     `GovernanceAdapter::apply_column_tags`.
  3. Resolves the project-level `[mask]` / `[mask.<env>]` config via
     `RockyConfig::resolve_mask_for_env(None)` into a tag → strategy
     map, filters the model's classifications that resolve, and calls
     `apply_masking_policy` with a populated `MaskingPolicy`.

Failures on either call emit a `warn!` and continue — mirroring the
`apply_grants` best-effort semantics earlier in the same function.
Models without a `[classification]` block short-circuit at the first
check with no adapter work.

Deliberate v1 scope:
  - `env = None` is passed to the resolver; the `--env` CLI flag is a
    follow-up. The resolver already accepts `Option<&str>`, so wiring
    a choice is non-breaking once the flag lands.
  - The `rocky plan` preview of these actions (the PlanOutput
    tag/mask rows from waveplan §2 item 6) is deferred. `plan` would
    need to walk the same resolver without a connected adapter — a
    small shape-only follow-up.
  - The `rocky-compiler` W004 warning for unresolved classification
    tags (waveplan §2 item 5) is deferred — the `RockyConfig`
    already retains `[classifications.allow_unmasked]` to suppress
    the warning once it lands.

Codegen cascade: `MaskStrategy` / `MaskingPolicy` / the new `[mask]`
+ `[classification]` config shapes deriving `JsonSchema` surface
through the project-level `rocky-project.schema.json`. Regenerated:
  - schemas/rocky_project.schema.json
  - integrations/dagster/.../rocky_project_schema.py
  - editors/vscode/schemas/rocky-project.schema.json
  - editors/vscode/src/types/generated/rocky_project.ts

* chore(engine): cargo fmt + clippy fixes for CI

- Run `cargo fmt` to absorb the formatting drift flagged by the CI
  rustfmt --check step across config.rs, masking.rs, models.rs,
  traits.rs, and rocky-databricks/governance.rs.
- Replace `.get("confidential").is_none()` with
  `!contains_key("confidential")` in the mask-resolver test per the
  clippy `unnecessary_get_then_check` lint.

No behavior change; same test assertions, same SQL output.

* chore(engine): cargo fmt with rustfmt 1.95.0 (CI fix)