Safety mode: read-only + destructive-op confirmation (keyword heuristics)

The headline feature. Keyword/prefix classification (no SQL parser — none covers all dialects; heuristics deliver the value): read-only mode allowlists SELECT/EXPLAIN/SHOW/WITH-SELECT; DDL/DML keywords require confirmation; per-source `readonly: true` in config. Parser-grade classification deliberately deferred.

**Acceptance:** in read-only mode no write statement reaches the driver (suite-tested per engine); confirm prompt on DROP/DELETE/UPDATE/ALTER/TRUNCATE/INSERT.

Start by locating the read-only mode, per-source configuration, driver execution path, and database-engine test suites. Trace how statements are classified and how confirmation prompts are handled. Done means read-only mode blocks writes for each engine and the listed destructive operations require confirmation.

Written by the indexing model from the issue text.