feat(postgres): add native read-only mode with RBAC startup verification - #4051

The verify query in postgres.go:157-183 (0c9a3712) returns f,f,f (superuser, table write, schema create) for some roles that can still write. The L197-198 error ("only SELECT privileges") implies it should catch 1, 2 and pg_* roles. For 3, read-only.md:111 (main) promises safe auto-execute and L31 names UDFs as a write route. Each needs an admin to have granted something or created a definer function; may be a scope call.

PG 17.11 and 15.19:

1. Column INSERT/UPDATE grant: INSERT 0 1, UPDATE 1.
2. NOINHERIT member of a writer group: direct INSERT denied, succeeded after SET ROLE. NOINHERIT pg_write_all_data: INSERT after SET ROLE succeeded (PG17).
3. SELECT-only reader calling a PUBLIC-executable SECURITY DEFINER function: row inserted.

Also f,f,f on PG17, yet able to write: pg_execute_server_program and pg_write_server_files members (COPY wrote files), and UPDATE on a sequence (setval). Controls: superuser t,t,t; direct and inheriting writers f,t,f; the reader was denied INSERT, UPDATE, COPY TO file and nextval.

Adding has_any_column_privilege and pg_has_role(..., 'MEMBER') flagged 1, 2 and pg_* roles, left the reader f,f,f. They miss the sequence and 3. No write was tried through execute_sql.

Are column grants and NOINHERIT in scope? Does 3 change the default_transaction_read_only call? Happy to add them to startupTCs.