sql_execute: DuckDB file-reading functions are classified as reads #1650

Found during the v0.12.9 release review (#1647).

On a DuckDB connection, select * from read_csv('/some/local/file') (and similar read_* table functions) is classified as a read, so a calling agent over MCP or tool run can read local files through sql_execute without --allow-write. The marginal risk is low for coding agents that already read files, but it is not obvious from the docs.

Suggested: document it in usage/tool.md, or treat local file table functions as needing --allow-write outside the project directory.

Deferred: needs a decision on the intended policy.