Thanks @David_Dabbs  for the accepting as a solution.

On table triggers: you were right the feature exists, but the Delta Sharing constraint kills it for your topology — tables shared via Delta Sharing are not supported  https://docs.databricks.com/aws/en/jobs/trigger-table-update as trigger sources. Explicit API call stands.

On CAN_TRIGGER: your model is correct. It's a per-job ACL granted to a specific principal — no workspace-level intermediary. Host URL is just addressing.