fix: keep portable doctor checks read-only

[steipete]

Summary

• inspect committed portable source databases through immutable SQLite URI connections
• keep ordinary local databases and writable runtime mirrors on the existing normal read-only path
• fail closed before opening SQLite when Git portability probing itself fails
• add end-to-end coverage proving doctor --json leaves canonical portable checkouts clean, plus a probe-failure regression

Root cause

SQLite may create -wal and -shm files even for an ordinary read-only connection to a WAL-mode database. Gitcrawl used those connections while inspecting the committed portable source database, so a nominally read-only doctor command could dirty the portable checkout.

Verification

• GOWORK=off go test ./...
• GOWORK=off go vet ./...
• total coverage: 85.0%
• Windows amd64 cross-compilation of affected CLI/store tests
• govulncheck ./...: no vulnerabilities found
• deadcode: clean
• release-script tests: passed
• black-box validation: two consecutive doctor runs reported current portable source diagnostics, pending runtime migration, and a clean checkout without -wal or -shm
• Codex autoreview: no accepted/actionable findings

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix: keep portable doctor checks read-only This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.