v0.12.0

Added

• MCP tool annotations derived from each tool's governance risk_level, so
  clients can gate approval from tools/list alone. low tools advertise
  readOnlyHint: true; every other tool advertises readOnlyHint: false and
  destructiveHint: true. The medium tier includes deletes and hard
  power-offs, so a tool is never advertised as non-destructive on the strength
  of its tier. idempotentHint only repeats an explicit declaration. The exact
  level is published in _meta under io.github.AIops-tools/riskLevel. These
  are hints for the client; audit and undo are unchanged.

Fixed

• vm_list / fleet_overview: ESXi VMs were never returned and cloned AHV VMs
  were mislabelled. The hypervisor was read from source.entityType, which in the
  v4 model names what a VM was cloned from (VM / VM_RECOVERY_POINT), so every
  clone was reported with hypervisor VM and include_esxi=False dropped it.
  ESXi VMs are now read from their own endpoint (/api/vmm/v4.0/esxi/config/vms)
  and labelled by the endpoint they came from. If the ESXi read fails, the AHV rows
  are still returned with esxiError set and truncated: null, and
  fleet_overview reports it in errors instead of counting zero ESXi VMs.
  ESXi rows carry numCpus, and their ipAddresses is null because it is not read.