ai: apply changes for #457 (1 review thread)

Addresses:
  - #3799637110 at CONNECTION_PARAMETERS.md:76

Signed-off-by: peco-engineer-bot[bot] <peco-engineer-bot[bot]@users.noreply.github.com>

Author: peco-engineer-bot[bot]

CONNECTION_PARAMETERS.md

@@ -73,7 +73,7 @@ column.
 | `socketTimeout`              | `number` (ms)            |   ✅   |   ⚠️   | `900000` (15 min) | Kernel maps it to the request timeout but forwards **only positive** values — `socketTimeout: 0` (Thrift "wait indefinitely") is omitted so the kernel keeps its large default.                                             |
 | `proxy`                      | `ProxyOptions`           |   ✅   |   ⚠️   | —                 | `{protocol, host, port, auth}`. Kernel accepts **`http://` / `https://` only**; a SOCKS `protocol` surfaces a kernel connect error (Thrift supports SOCKS variants).                                                        |
 | `noProxy` (internal)         | `string`                 |   ❌   |   ✅   | —                 | **Thrift ignores `noProxy`** — `getConnectionOptions` never threads it, and `getProxyForUrl: () => proxyUrl` returns the proxy for every URL (no bypass-list logic). Only the kernel honors it, forwarded as `bypassHosts`. |
-| `customHeaders`              | `Record<string, string>` |   ✅   |   ✅   | —                 | Kernel drops reserved `Authorization` / `x-databricks-org-id`, rejects CR/LF/NUL, and appends the connector `User-Agent` last.                                                                                              |
+| `customHeaders`              | `Record<string, string>` |   ⚠️   |   ✅   | —                 | **Thrift: out-of-band requests only.** `getConnectionOptions` never threads `customHeaders` into the Thrift query transport (it sets only `User-Agent`); the map is consumed by `buildCustomHeaders` for driver-owned telemetry POSTs / feature-flag GETs and SPOG `x-databricks-org-id` injection, not the primary transport or OAuth/OIDC token requests. Kernel applies them to every request (dropping reserved `Authorization` / `x-databricks-org-id`, rejecting CR/LF/NUL, appending the connector `User-Agent` last).                                                                                              |
 | `retryMaxAttempts`           | `number`                 |   ✅   |   ✅   | `5`               | Total-attempt semantics on both; kernel converts to retries-after-first.                                                                                                                                                    |
 | `retriesTimeout`             | `number` (ms)            |   ✅   |   ✅   | `900000` (15 min) | Kernel converts ms → whole seconds.                                                                                                                                                                                         |
 | `retryDelayMin`              | `number` (ms)            |   ✅   |   ✅   | `1000` (1 s)      | Kernel converts ms → seconds.                                                                                                                                                                                               |