Expose the existing governed SELECT service through Tool API

Problem

The governed SELECT capability currently lives behind a Drush command. A connector therefore needs a module-specific command wrapper instead of discovering a typed module-owned action through the existing MCP Tool API bridge.

Proposed resolution

Extract the shared governed query execution into a service and expose a typed Tool API action that reuses it. Preserve the existing Drush command. Resolve the applicable policy from the authenticated tool account; do not let a caller select a more permissive profile. Preserve the explicit raw-SQL opt-in, SELECT-only validation, field/table restrictions, finite read and egress budgets, classification/DLP controls, and audited failure handling. Require the existing governed tool access path on discovery and direct execution. No raw database fallback.

Acceptance

Both adapters exercise the same execution service. Tests cover disabled governance/audit, absent or ineligible policy, wrong scope/account, disallowed statements and fields, finite output, query failure and audit failure. Tool failures remain failures. No query text or returned record values appear in generic error messages. Document the tool contract and keep the supported Drupal versions covered by CI.