fix(google-vault): validate against live API docs, add matter/hold/saved-query CRUD coverage (#5482)

* fix(google-vault): validate integration against live API docs, add matter/hold/saved-query CRUD coverage

- Fix critical bug: create_matters_export sent the deprecated Query.searchMethod field (deprecated 2019, support ended 2020) instead of method, silently breaking account/org-unit scoped exports
- Fix duplicate matterId subBlock id (two definitions collided across operations)
- Add matter lifecycle: update, close, reopen, delete, undelete
- Add matter collaborator management: add/remove permissions
- Add export delete
- Add hold update, delete, add/remove held accounts
- Add saved query create/list/delete
- Bump tool versions to 1.0.0 to match repo convention
- Fix docsLink to point at docs.sim.ai instead of the vendor site
- All new endpoints are covered by the existing ediscovery + devstorage.read_only OAuth scopes (no new scopes requested)

* fix(google-vault): pageToken should be user-or-llm visibility, not hidden

Greptile review: hidden is reserved for framework-injected tokens; pageToken
in list_saved_queries.ts should be user-or-llm so an agent/user can pass it,
matching the pattern used elsewhere for tool-supplied pagination cursors.

* fix(google-vault): fail loudly instead of silently clearing hold scope on update

Cursor Bugbot: PUT holds/{id} replaces the full resource — a name/query-only
update with no accountEmails/orgUnitId would silently drop the hold's
custodian coverage. Now throws a clear error directing callers to resend the
scope or use add_held_accounts/remove_held_accounts for incremental changes.

* fix(google-vault): reject unscoped exports/saved-queries for non-MAIL corpus

Independent audit (parallel doc-verification pass): create_matters_export
and create_saved_query resolved Query.method to undefined when corpus
wasn't MAIL and no accountEmails/orgUnitId was given, silently sending an
invalid request (method is a required Query field) instead of a clear
error. Now throws with an actionable message before the request is sent.

* fix(google-vault): document full-replace semantics on hold update query filters

Cursor Bugbot: update_matters_holds only sets query.mailQuery/groupsQuery/
driveQuery when terms/date/shared-drive fields are provided, but the PUT
replaces the whole hold — omitting a previously-set filter clears it, not
leaves it unchanged. Filters are legitimately optional (a hold may have
none), so this can't be hard-required like scope; instead the tool and
field descriptions now explicitly state the full-replace behavior and
direct callers to resupply current values via Vault List Holds first.

* fix(google-vault): isolate stale-value-prone subblocks per operation

Cursor Bugbot: consolidating shared subblocks across operations left two
cross-contamination risks since a stale value from one operation stays in
block state until overwritten:

- accountEmails/orgUnitId are checked emails-first with silent either/or
  priority; sharing them across update_matters_holds and create_saved_query
  meant a leftover value from a different operation could silently override
  the intended scope. Gave both operations dedicated fields
  (updateHoldAccountEmails/updateHoldOrgUnitId, savedQueryAccountEmails/
  savedQueryOrgUnitId), remapped in tools.config.params.
- matterId presence alone switches google_vault_list_matters between
  list-all and single-get. Sharing it with every other operation meant a
  leftover matterId could silently turn "List Matters" into a single-matter
  fetch. Gave list_matters its own optional listMatterId field.

create_matters_holds/create_matters_export keep sharing accountEmails/
orgUnitId as before this PR (pre-existing behavior, not introduced here).

* fix(google-vault): isolate list-optional-id fields from required-elsewhere counterparts

Cursor Bugbot: exportId/holdId/savedQueryId were shared between their
respective list operation (optional filter) and update/delete/held-account
operations (required). A stale ID left over from a delete/update on the
same block instance would silently narrow the corresponding list operation
to a single-resource get instead of listing the collection. Gave each list
operation its own dedicated optional field (listExportId, listHoldId,
listSavedQueryId), remapped in tools.config.params — same pattern already
used for listMatterId.

* fix(google-vault): defensively order mutually-exclusive scope spreads

Greptile: savedQueryAccountEmails/savedQueryOrgUnitId spread after their
updateHold* counterparts, so if both were ever truthy at once the wrong
one would silently win. In practice they're mutually exclusive (each only
populated while its own single 'operation' value is selected, so at most
one pair is ever truthy), but reordering costs nothing and removes any
doubt about precedence.

* docs: regenerate integration docs

Reruns scripts/generate-docs.ts against the current block/tool/trigger
registry. Picks up google_vault's new operations plus everything else that
had landed on staging without a docs regen (bigquery, google_calendar,
google_maps, onedrive, microsoft_teams, gitlab, github, discord, dropbox,
and others), plus icon and integrations.json updates.

Author: waleedlatif1

apps/docs/components/icons.tsx

@@ -166,6 +166,45 @@ List recent Athena query execution IDs
 | `queryExecutionIds` | array | List of query execution IDs |
 | `nextToken` | string | Pagination token for next page |
 
+### `athena_batch_get_query_execution`
+
+Get the status and details of up to 50 Athena query executions in one call
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) |
+| `awsAccessKeyId` | string | Yes | AWS access key ID |
+| `awsSecretAccessKey` | string | Yes | AWS secret access key |
+| `queryExecutionIds` | string | Yes | Comma-separated query execution IDs to check \(up to 50\) |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `queryExecutions` | array | Details for each successfully retrieved query execution |
+|   ↳ `queryExecutionId` | string | Query execution ID |
+|   ↳ `query` | string | SQL query string |
+|   ↳ `state` | string | Query state \(QUEUED, RUNNING, SUCCEEDED, FAILED, CANCELLED\) |
+|   ↳ `stateChangeReason` | string | Reason for state change |
+|   ↳ `statementType` | string | Statement type \(DDL, DML, UTILITY\) |
+|   ↳ `database` | string | Database name |
+|   ↳ `catalog` | string | Data catalog name |
+|   ↳ `workGroup` | string | Workgroup name |
+|   ↳ `submissionDateTime` | number | Query submission time \(Unix epoch ms\) |
+|   ↳ `completionDateTime` | number | Query completion time \(Unix epoch ms\) |
+|   ↳ `dataScannedInBytes` | number | Amount of data scanned in bytes |
+|   ↳ `engineExecutionTimeInMillis` | number | Engine execution time in milliseconds |
+|   ↳ `queryPlanningTimeInMillis` | number | Query planning time in milliseconds |
+|   ↳ `queryQueueTimeInMillis` | number | Time the query spent in queue in milliseconds |
+|   ↳ `totalExecutionTimeInMillis` | number | Total execution time in milliseconds |
+|   ↳ `outputLocation` | string | S3 location of query results |
+| `unprocessedQueryExecutionIds` | array | Query execution IDs that could not be retrieved, with error details |
+|   ↳ `queryExecutionId` | string | Query execution ID |
+|   ↳ `errorCode` | string | Error code |
+|   ↳ `errorMessage` | string | Error message |
+
 ### `athena_create_named_query`
 
 Create a saved/named query in AWS Athena
@@ -235,4 +274,85 @@ List saved/named query IDs in AWS Athena
 | `namedQueryIds` | array | List of named query IDs |
 | `nextToken` | string | Pagination token for next page |
 
+### `athena_delete_named_query`
+
+Delete a saved/named query in AWS Athena
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) |
+| `awsAccessKeyId` | string | Yes | AWS access key ID |
+| `awsSecretAccessKey` | string | Yes | AWS secret access key |
+| `namedQueryId` | string | Yes | Named query ID to delete |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `success` | boolean | Whether the named query was successfully deleted |
+
+### `athena_list_databases`
+
+List the databases available in an Athena data catalog
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) |
+| `awsAccessKeyId` | string | Yes | AWS access key ID |
+| `awsSecretAccessKey` | string | Yes | AWS secret access key |
+| `catalogName` | string | Yes | Data catalog name to list databases from \(e.g., AwsDataCatalog\) |
+| `workGroup` | string | No | Workgroup for which the metadata is being fetched \(required for IAM Identity Center enabled catalogs\) |
+| `maxResults` | number | No | Maximum number of results \(1-50\) |
+| `nextToken` | string | No | Pagination token from a previous request |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `databases` | array | List of databases \(name, description\) |
+|   ↳ `name` | string | Database name |
+|   ↳ `description` | string | Database description |
+| `nextToken` | string | Pagination token for next page |
+
+### `athena_list_table_metadata`
+
+List tables and their column/partition metadata for an Athena database
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) |
+| `awsAccessKeyId` | string | Yes | AWS access key ID |
+| `awsSecretAccessKey` | string | Yes | AWS secret access key |
+| `catalogName` | string | Yes | Data catalog name \(e.g., AwsDataCatalog\) |
+| `databaseName` | string | Yes | Database name to list tables from |
+| `expression` | string | No | Regex filter that pattern-matches table names |
+| `workGroup` | string | No | Workgroup for which the metadata is being fetched \(required for IAM Identity Center enabled catalogs\) |
+| `maxResults` | number | No | Maximum number of results \(1-50\) |
+| `nextToken` | string | No | Pagination token from a previous request |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `tables` | array | Table metadata \(name, type, columns, partition keys\) |
+|   ↳ `name` | string | Table name |
+|   ↳ `tableType` | string | Table type |
+|   ↳ `createTime` | number | Table creation time \(Unix epoch ms\) |
+|   ↳ `lastAccessTime` | number | Table last access time \(Unix epoch ms\) |
+|   ↳ `columns` | array | Column definitions |
+|     ↳ `name` | string | Column name |
+|     ↳ `type` | string | Column data type |
+|     ↳ `comment` | string | Column comment |
+|   ↳ `partitionKeys` | array | Partition key definitions |
+|     ↳ `name` | string | Partition key name |
+|     ↳ `type` | string | Partition key data type |
+|     ↳ `comment` | string | Partition key comment |
+| `nextToken` | string | Pagination token for next page |
+