Remove EQL v2 installation and Proxy lifecycle tooling from stash and migrate

[tobyhede]

Part of #778 and the EQL v2 removal.

Remove the remaining EQL v2 installation and rollout leaf from packages/cli and packages/migrate.

Acceptance criteria:

• Delete vendored EQL v2 SQL, v2 install routing, Proxy configuration lifecycle commands, cutover implementation, and obsolete flags including eql-version and latest.
• Keep eql upgrade on its v3-only default path.
• Retain legacy v2 status/read diagnostics, manifest fallbacks needed to display existing deployments, and the rewrite token needed for old migration history.
• Reject removed v2 CLI options clearly and point dump-recovery users to the upstream EQL 2.3.1 SQL release.
• Update affected skills, command manifest coverage, tests, and changesets in the same change.

This is the CLI/migrate removal track; it must not remove v2 ciphertext read compatibility.

[tobyhede]

Delivered — closing (2026-07-30)

Completed by #825, merged as bf7be099, which is an ancestor of origin/main (c8b1325a). It reached main inside the #772 umbrella merge (d5a22338).

Why this stayed open: #825 targeted the remove-v2 branch, not the default branch. GitHub only honours closing keywords on merge into the default branch, and #825 carried no closing keyword for this issue at all — its closingIssuesReferences is empty and its only link here is the branch name fix/issue-814-remove-cli-migrate-v2. So nothing ever fired.

All five acceptance criteria verified against origin/main:

1. Deleted — packages/cli/src/commands/encrypt/cutover.ts, db/push.ts, db/activate.ts, db/supabase-migration.ts, packages/migrate/src/eql.ts, and the vendored EQL v2 SQL.
2. eql upgrade retained on its v3-only default — packages/cli/src/commands/db/upgrade.ts.
3. Read-only diagnostics retained — db/status.ts:98-129, packages/migrate/src/version.ts.
4. Removed options rejected clearly, dump recovery pointed upstream — main.ts:305 (db push/activate), main.ts:378-380 (encrypt cutover), db/install.ts:34 (--eql-version), init/index.ts:74-79 (--proxy/--no-proxy); EQL 2.3.1 pointer at skills/stash-cli/SKILL.md:355 and skills/stash-encryption/SKILL.md:1018.
5. Skills, tests, changesets updated in the same change — packages/cli/src/__tests__/v2-retirement.test.ts, packages/migrate/src/__tests__/v2-retirement.test.ts, packages/cli/tests/e2e/v2-retirement.e2e.test.ts, scripts/__tests__/no-removed-eql-version-flag.test.mjs, changeset .changeset/remove-cli-migrate-v2-leaf.md.

Also closed incidentally: the introspect.ts defect flagged in #707's comments — packages/cli/src/commands/init/lib/introspect.ts:67 now matches udtName === 'eql_v2_encrypted' || udtName.startsWith('eql_v3_').

Residual db push references in wizard source and tests are tracked in #837.