Make EQL v3 installable via the CLI (follow v2 installer pattern)

[tobyhede]

Summary

EQL v3 schema/type support landed with a vendored SQL bundle and a test-only helper (installEqlV3IfNeeded), but v3 is not installable via the CLI. The CLI EQLInstaller is currently hardcoded to v2. This issue tracks extending the CLI so users can install EQL v3, mirroring the existing v2 installer pattern.

Background

• v3 schema work + tests currently rely on packages/stack/__tests__/fixtures/eql-v3/cipherstash-encrypt-v3.sql and the test helper packages/stack/__tests__/helpers/eql-v3.ts (installEqlV3IfNeeded). This is test infrastructure only.
• v2 is shipped/installable via packages/cli/src/installer/index.ts (EQLInstaller), which is hardcoded:
  • EQL_SCHEMA_NAME = 'eql_v2'
  • EQL_VERSION = 'eql-2.3.1'
  • GitHub release URLs for cipherstash-encrypt.sql / cipherstash-encrypt-supabase.sql
• v2 bundles are vendored in packages/cli/src/sql/ (standard, supabase/no-operator-family variants) and covered by packages/cli/src/__tests__/installer.test.ts.

Scope

• Vendor the v3 bundle into packages/cli/src/sql/ (plus supabase / no-operator-family variants if they exist for v3), alongside the v2 bundles.
• Make EQLInstaller schema-aware instead of hardcoded to eql_v2 — add v3 schema name, version, and GitHub release URLs.
• Define the CLI surface for selecting v3 (e.g. --v3 flag, --eql-version, or install both). Decide default behaviour.
• Decide install semantics: v2 and v3 coexist as separate schemas vs. migration path.
• Mirror installer.test.ts for the v3 path: isInstalled -> eql_v3, bundled-vs-GitHub install, permission checks, Supabase grants, rollback.

Open question

Reconcile bundle duplication: the CLI vendors its own copy of v2 SQL. Following the v2 pattern means the CLI gets its own copy of the v3 bundle rather than sharing the one under packages/stack/__tests__/fixtures/eql-v3/. Confirm this is acceptable or introduce a shared source of truth.

Out of scope

The EQL v3 schema/type work and its stack-level tests (already handled on the feat/eql-v3-text-search-schema branch).