tiger db psql fails to connect — FATAL: cannot disable read-only mode (SQLSTATE 25006)

Tiger CLI 0.23.0, windows/amd64. Config: read_only: all.

With read_only: all set, the CLI appends options=-c tsdb_admin.read_only_connection=true to the connection string, which causes a server error when connecting:

$ tiger db psql <service-id> --role <role>
Error: failed to connect to user=<role> database=tsdb:
        server error: FATAL: cannot disable read-only mode: connection is in protected read-only state (SQLSTATE 25006)

The same connection string without that parameter connects fine.

Also, if run immediately before it — same role, same service, same config:

$ tiger db test-connection <service-id> --role <role>
Connection successful

test-connection evidently does not send that parameter, so it reports healthy for a role/config pair that cannot actually connect.

Note the message says the connection is being disabled when the client asked to enable read-only mode.

Start with the tiger db psql and tiger db test-connection command entry points and trace how each constructs its connection string. Reproduce the read_only: all case, compare their handling of tsdb_admin.read_only_connection=true, and add coverage showing that the affected role can connect consistently.