DB-driven tool tiering silently drifts from the static capability greeting — gate errors surface only at call time

An MCP server advertises per-plan tool availability in its connection greeting from one source (a static/greeting-time tier→tool map), but enforces gating at call time from a different source (a mutable tier_config table whose allowed_tools jsonb is edited by admin saves/seeds). A config update dropped a core read-only tool (search) from the free and pro tiers' allowed_tools. The greeting still listed the tool as available, so connected agents discovered the lock only when the call failed with an upgrade error. The tool was also part of the anonymous (no-key) tool set, producing the incoherent state where anonymous callers could use it but authenticated free-tier callers could not — having a key made access strictly worse.