Add sqlx mcp and native integrations for dsh, pi, Codex and Claude Code

[openai0229]

What

Adds one tool surface and four thin harness adapters so agents call SQLX as a tool instead of shelling out to the CLI.

sqlx mcp — a Model Context Protocol server over stdio (crates/cli/src/mcp.rs):

• Tools: sqlx_datasource_list, sqlx_datasource_show, sqlx_datasource_test, sqlx_sql_execute, sqlx_sql_view, sqlx_prefetch.
• readOnlyHint/destructiveHint annotations carry the Skill's authorization contract into the tool layer; write-capable tools state the requirement in their descriptions.
• execution::run gained run_to(writer, …) so results can be captured instead of written to stdout, which the MCP protocol owns.
• 4 unit tests (tool inventory/annotations, protocol negotiation, notifications and unknown methods, tool failures as results).

Adapters (integrations/):

• claude/ — plugin plus marketplace manifest; .mcp.json launches sqlx mcp through the plugin's bin/sqlx-mcp launcher.
• codex/ — plugin plus marketplace manifest; same launcher, with an env_vars allowlist so the plugin can see SQLX_BIN/SQLX_DATA_DIR.
• dsh/ — npm bundle (dsh.bundle.patch → cordis.patch.yml) registering five native tools through defineTool.
• pi/ — npm package with a registerTool extension.
• README.md records install commands, the credential rule and the verification results.

Verification

All four ran the same task headlessly (list datasources, execute a read-only SELECT, reply with the exact value):

Harness	Version	Result
Codex CLI	0.155.1	9007199254740993
Claude Code	2.1.236, re-verified on 2.1.278	9007199254740993
Pi	0.86.0, re-verified on 0.86.1	9007199254740993
DeepSeek Harness	0.1.5-rc.1	9007199254740993

Local checks: cargo fmt --check, cargo clippy --workspace --all-targets --locked -D warnings, cargo test -p ottermind-sqlx --locked, and a scripted MCP session against a real PostgreSQL datasource.

Behaviour worth noting from the verification:

• Codex runs read-only MCP tools without approval and refuses sqlx_sql_execute until approvals are granted (MCP tool call requires approval, but approval policy is never) — the intended gating.
• Claude Code needs an explicit tool allowlist in headless mode, for example --allowedTools "mcp__plugin_sqlx_sqlx__*".
• Credentials must live in the SQLX data directory: datasources created with --username-env/--password-env read the process environment, which a GUI-launched harness usually cannot see.
• The dsh and pi npm plugins must be installed packed (pnpm pack); a link: install breaks module resolution for host-provided packages, so @deepseek-ai/dsh-tools is declared as a peer dependency the same way other third-party bundles declare it.

Risks and limits

• The adapters require a CLI that provides sqlx mcp. While this branch is unreleased the verification pointed SQLX_BIN at the local build and SQLX_MANIFEST at the published v0.1.6 manifest, because a v0.1.8 manifest does not exist yet.
• The plugins do not install the CLI. The launcher uses SQLX_BIN or the first sqlx on PATH; documenting npx -y @ottermind/sqlx@latest or shipping per-platform binaries in the plugin bin/ is follow-up work.
• Codex and Claude Code distribution needs a git marketplace. A manifest-only repository is the verified path; using an orphan branch of this repository so users never clone the source is untested, because Codex only accepts --ref for HTTPS/SSH git sources and needs a real remote to prove.
• integrations/pi and integrations/dsh are npm packages but are not published yet.