feat: add read-only PostgreSQL agent tool

[khaale]

Summary

• add the pgc CLI with named PostgreSQL sessions and secret-safe diagnostics
• enforce read-only queries with bounded results and sanitized errors
• add progressive schema overview, comment-aware search, table details, availability status, and FK relationships
• add cross-environment comparison of two read-only queries by explicit key columns
• add the companion skill, OpenSpec artifacts, changeset, dev-install wrapper, and repository README documentation

Verification

• pnpm check
• openspec validate add-postgres-agent-tool --type change --strict --json
• read-only smoke tests against the local be-plan_local PostgreSQL session
• pre-commit test hook passed