v3.0.0

Breaking changes

Changes:

• Removed generate_sysql/run_sysql tools (+ tests) and the
  GenerateSysql client extension (+ integration test, mocks
  regenerated).
• Cleaned up orphaned permissions sage.exec and risks.read (only
  metrics-data.read remains).

Other changes

• Updated docs (README, AGENTS, tools/README, TROUBLESHOOTING) and
  .claude/settings.local.json.
• just update: bumped Go deps, flake.lock and base images.

Note: QuerySysql*/GetSysqlSchema stay in client.gen.go since
they're generated from the OpenAPI spec (DO NOT EDIT, they come back on
the next just update).