Boyce: Secure AI Agent SQL with Semantic Safety Layer