fix(editor): tier etcd statements by the operation the driver parses so lease revoke is destructive

[datlechin]

Summary

• etcd lease revoke (which deletes every key attached to the lease), user delete, role delete and auth disable skipped the destructive confirmation and were allowed for an external client that may write but may not run destructive statements. The classifier tiered etcd text by its first word against a hand-written verb list that does not match the commands the plugin's parser takes, so every lease, user, role and auth subcommand fell to the write tier; it now tiers the operation EtcdCommandParser returns, in one exhaustive switch.
• etcd member list, lease list, lease timetolive, user list and role list were gated as writes, so an external client with read-only access was refused and write confirmation prompted for them. Same root cause: the verb list never looked at the subcommand.
• A quoted command such as "del" /keys --prefix or "lease" revoke 7b dropped to a write. The first word was read raw instead of the way the driver's tokenizer reads it; text the parser rejects is now tiered by its leading word as the driver tokenizes it, failing closed to destructive for commands that can delete keys or remove access.

Tests

In TableProTests/Core/Utilities/SQL/QueryClassifierHardeningTests.swift (suite QueryClassifierNonSqlTests):

• etcdDestructiveSubcommands: lease revoke and its upper-case and quoted spellings, user delete, role delete, auth disable, quoted "del", delete and compaction are destructive. Fails without the fix (7 expectations).
• etcdReadSubcommands: member list, lease list, lease timetolive, endpoint status, endpoint health, user list, role list and quoted 'get' are safe. Fails without the fix (6 expectations).
• etcdUnparsedFailsClosed: rejected text whose command can destroy (del --from-key /a, lease revoke with no id, member remove) is destructive, other rejected text is a write, defrag reaches the filesystem. Fails without the fix (3 expectations).
• etcdWriteSubcommands: grants, keep-alives, account additions and put stay writes. Passes before and after; it guards against over-tightening.

The existing etcdTiers case, the etcd cases in MCPStatementGateRefusalTests and MCPStatementGateConsentPolicyTests, and the EtcdCommandParser suites pass unchanged.

Docs

The docs rewrite branch covers the user-facing text for which etcd commands ask for confirmation and which count as reads.