Nightly (main)

feat: expose cancellable read-only Kuzu connections

- Add a strict read-only constructor option, pass it through ATP, and
  reject initialization when the backend omits read-only database
  capability.
- Propagate the active read-cancellation context into row-partition
  workers while preventing owner state from leaking into reused executor
  threads.
- Check cancellation before and after each partition task so
  cancellation during materialization cannot release a stale result.
- Preserve ordinary executor behavior after a cancelled scoped read.
- Prove read-only queries preserve database bytes across reopen cycles
  and reject writes against filesystem-protected storage.
- Cover invalid read-only values, missing native capability, scoped
  context restoration, and cancellation during row materialization.