SQL read/write classifier: DuckDB reads refused, file-reading functions allowed #1679

The read-only classifier both refuses valid reads and allows reads with side effects. Keep the allowlist approach (sql-function-policy.ts) and fail closed.

Items

• SQL read/write classifier fails closed on valid reads (//, typed TIMESTAMPTZ literals, NOT GLOB, CREATE+SELECT) and reports a misleading "user rule" error #1488: Valid reads fail closed: scratch CREATE …; SELECT … batches and some parser constructs.
• tool run: read-only DuckDB statements are refused as writes, and the refusal names an internal permission #1648: tool run: read-only DuckDB statements such as SUMMARIZE and CALL pragma_version() are refused as writes, and the refusal names an internal permission.
• sql_execute: DuckDB file-reading functions are classified as reads #1650: DuckDB file-reading functions (read_csv, read_parquet, …) are classified as reads; decide the local-file policy or add a path permission check.

The linked issues hold the original reports and reproductions. Most are closed in favor of this tracker; any child with an open fix PR stays open until that PR lands.