docs: add optional HOL Guard boundary to infra-clickhouse

[kantorcodes]

Summary

• adds an opt-in HOL Guard setup to infra-clickhouse for supported local coding-agent harnesses before state-changing clickhousectl workflows
• keeps ClickHouse authentication, RBAC, quotas, and audit controls authoritative; it explicitly does not claim Guard protects ClickHouse itself or the remote Cloud API
• bumps the skill and metadata version together to 0.3.1

Why

infra-clickhouse already guides agents through workflows that can create or mutate local and cloud resources. This gives users who want it a separate local agent-runtime boundary before tool execution without replacing ClickHouse-native controls.

Validation

• version is aligned between SKILL.md and metadata.json
• no ClickHouse command behavior is changed
• runtime execution is not claimed; this is a docs-only integration

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}