INSERT INTO ... SELECT never returns (request hangs)

## Summary

`INSERT INTO SELECT ... FROM ` never returns. The request hangs indefinitely rather than erroring or completing.

## Reproduction

Against a fixture with two tables in `data`, as a **super_user**:

```json
{ "operation": "sql",
"sql": "INSERT INTO data.UnqualPublic SELECT id, ssn AS label FROM data.UnqualSecret" }
```

The connection produces no response. With an 8s client-side bound the request aborts with `ECONNABORTED`; without one, an integration suite containing this statement ran past 900s and had to be killed. Both were reproduced on `main` behavior via a scratch probe under `integrationTests/security/`.

For contrast, the neighbouring compound forms all fail fast rather than hanging:

| Statement | Result |
| --- | --- |
| `INSERT INTO t SELECT ... FROM src` | **no response** |
| `SELECT ... UNION SELECT ...` | 500 |
| `SELECT ... WHERE id IN (SELECT ...)` | 500 `Circular reference` |
| `SELECT ... WHERE EXISTS (SELECT ...)` | 500 `Circular reference` |
| `SELECT * INTO t FROM t` | 200 (INTO ignored, no write) |

## Impact

A hung request ties up its handler. Repeated calls are an availability risk, so this is worth treating as more than a correctness bug.

harper#1961 (GHSA-5c29-q62v-jrwf) refuses this construct at the authorization layer, which removes the vector for **non**-super-users as a side effect of a different fix. It does not fix this: `verifyPermsAST` returns early for super-users, so they still reach the hang, and the fix is authorization-shaped rather than a fix to whatever actually wedges.

## Suggested direction

Find where the INSERT-with-source-query path stalls (it should surface as an unsupported-construct error like its siblings do), and separately consider whether the SQL path needs a general watchdog so no statement can hold a handler open indefinitely.

Found while validating the fix for GHSA-5c29-q62v-jrwf.

Start with the scratch probe under integrationTests/security/ and reproduce the INSERT INTO ... SELECT hang against the data fixtures. Trace the INSERT-with-source-query path, comparing its handling with the neighbouring compound forms and verifyPermsAST; done means the statement fails fast with an unsupported-construct error rather than holding the request open.

Written by the indexing model from the issue text.