NBK-161: migrate DDSQL execution to public v2 API

[nmuldavin]

Linear

NBK-161 — https://linear.app/datadoghq/issue/NBK-161/pup-migrate-ddsql-execution-to-the-public-apiv2ddsqlquerytabular

Outcome

Pup’s DDSQL table and time-series commands use the public v2 tabular query and fetch contract through one shared codepath.

Scope

• Migrate ddsql table and ddsql time-series execution from the unstable Advanced Query API to /api/v2/ddsql/query/tabular and /fetch.
• Validate v2 time-window and row-limit requirements client-side, poll attributes.state, and parse the single-object column-major response.
• Preserve verbatim SQL, meta.client_id, and OAuth/API-key handling.
• Security-owned commands remain on their existing Advanced Query API path and are outside this migration.
• DDSQL discovery routes, CSV formatting, legacy interval/offset behavior, and async-loop bounding are also non-goals.

Acceptance

• Both DDSQL query commands use the public v2 execute/fetch endpoints; security commands remain unchanged.
• Requests use ddsql_query_request, and relative, Unix-second, Unix-millisecond, and RFC3339 time inputs reach v2 as integer millisecond bounds with from < to; optional row_limit is validated to 1–10000.
• SQL remains verbatim and no per-dataset time is emitted by the public v2 request.
• Polling uses attributes.state; fetch attributes contain only query_id.
• Public v2 column-major responses under a single data object convert to rows.
• meta.client_id is preserved.
• Immediate completion, async fetch, OAuth, HTTP errors, and malformed response states have test coverage.
• OAuth prerequisite NBK-169 (formerly NMS-6) is Done.

Validation

• cargo test -- --test-threads=1 — passed; 1,903 tests, including exact v2 time forwarding for relative, Unix-second, Unix-millisecond, and RFC3339 inputs, execute/fetch transport coverage, and retained AQA-shape coverage.
• cargo clippy --all-targets -- -D warnings — passed.
• cargo fmt --check — passed.
• cargo build — passed.
• git diff --name-only origin/main...HEAD -- src/commands/security.rs — empty; the security-owned command is unchanged in the final PR diff.

Not run / automation gaps

• cargo audit — unavailable because the cargo-audit subcommand is not installed; this change adds no dependencies.
• No live Datadog API probe was run; request, auth, polling, response, and error behavior are covered with local HTTP mocks.

Material deviations and decisions

• Security findings analysis was removed from NBK-161’s scope after review and explicit human direction; the Linear acceptance criteria were corrected accordingly.

Remaining work or conditions

• Human review and approval.