Summary

• add a dedicated explicit-TCP dolt sql helper for verification paths
• switch VerifyServerDataDir's fallback SHOW DATABASES query to that helper
• preserve inherited DOLT_CLI_PASSWORD only for remote fallback checks when config omits a password
• add focused tests for local and remote explicit-TCP command construction

Why

Builds on the explicit-TCP helper work in #3470 and the daemon-helper parity follow-up in #3482.

VerifyServerDataDir still had one fallback path that could issue SHOW DATABASES through the older local dolt sql behavior. That left imposter detection able to drift back into embedded-mode / autodiscovery behavior instead of querying the live shared server.

This PR keeps that remaining fallback path on the same explicit TCP client path without broadening into unrelated Dolt shellout cleanup.

Validation

• GOTOOLCHAIN=auto go test ./internal/doltserver -run 'TestBuildDoltSQLTCPClientCmd_(Local|Remote|RemoteNoPasswordPreservesInheritedCredentials)$|TestBuildDoltSQLCmd.*|TestCheckServerReachable.*|TestIsRunning.*'

Notes

• Follow-up to fix: keep daemon Dolt verification in TCP client mode #3482.
• Builds on the explicit-TCP rationale from fix: force local dolt sql helper to use TCP client mode #3470.
• Intentionally limited to internal/doltserver verification fallback behavior and focused tests.