feat(mcp)!: rename pond_sql_query to pond_sql and make the tool surface route

[tenequm]

Why

Clients that matter (Claude Code, Codex) defer MCP tool descriptions behind tool search. The surfaces that actually route an agent are the always-loaded server instructions, the bare tool names, an installed skill, and error messages at the point of failure - not the carefully-written descriptions nobody sees before choosing. A field-tested misroute proved it: "analyze this session" bound to the SQL tool via the word "analytic" in the instructions, when the right call was one pond_get(session_id).

This PR makes every routing surface carry its weight, and folds in the highest-leverage finding from the retrieval ergonomics field test (#59): the supersession blind spot.

Breaking

• MCP tool pond_sql_query -> pond_sql - matches the pond sql CLI verb and drops the generic "query" attractor from the always-visible tool name. No other wire change.

What changed

Routing surfaces

• Server instructions now carry all routing: analyze/review/summarize a session binds to pond_get(session_id); latest-state questions steer to session_from="end" / sort_by="recency" (supersession guard); pond_sql self-demotes to the escape hatch; cookbook detail evicted to the schema:// resources.
• Tool descriptions lead with the verbs they claim (find / read / escape hatch) and shrink to ToolSearch-bait + contract.
• The sql query param keeps the column lists and gains the tool_call body-shape map ({call_id, name, params} - a Bash command is $.params.command), fixing a real observed failure (agents guessing $.command, silently getting 0 rows).
• Error hints teach at the failure point: the schema hint gains the body shapes; the timeout hint names the remote-store round-trip cost and the pond_get alternative.
• pond_get later-messages page marker now warns that conclusions may have been revised and names session_from="end" (the docs: pond retrieval ergonomics field test (external session) #59 core finding, verified live).

Skill

• SKILL.md rewritten: trigger verbs in the description (analyze/review/summarize/"check pond"), a which-tool router, and "rules that prevent wrong conclusions" (absence is not proof, supersession, tool-body shapes, remote parts cost).
• pond init installs the bundled skill to ~/.claude/skills/pond/SKILL.md under the same consent as MCP registration - idempotent on re-runs, and a hand-edited copy is never overwritten without an explicit confirm (+ unit test).

Latent release bug

• SKILL.md was in Cargo.toml exclude while being include_str!'d into the binary - the next cargo publish verify build would have failed on the missing file. It now ships in the package (verified with cargo package --list).

Verified against the real binary (local store, read-only)

• The docs: pond retrieval ergonomics field test (external session) #59 "200 empty system carrier messages" artifact is already fixed: page 1 of a session with 15,500 system messages renders 16 assistant + 4 user, zero carriers.
• The "later messages" count marker existed; only the supersession phrasing was missing (added here).
• The fat-cell problem is real and confirmed worse than reported: one 42,487-char cell rendered a 214KB response (row-halving budget loop has a shown > 1 floor; table padding amplifies ~5x). Fixed in the follow-up commit on this branch: inline table cells now clip at 1000 chars with a full-value marker - the same query renders 5,534 bytes (was 214,556), verified end-to-end. Export modes are never clipped.

Validation

cargo fmt --check clean, cargo clippy --all-targets -- -D warnings clean, cargo test green: 195 lib + 29 bin + 49 integration, 0 failures. Rename verified end-to-end by the sql::pond_sql_over_mcp integration test (tools/list + call over stdio MCP).