fix: stop requiring readonly connection config

docs-site/content/docs/cli-reference/ktx-connection.mdx

@@ -63,8 +63,7 @@ agents.
   "connections": [
     {
       "id": "my-warehouse",
-      "driver": "postgres",
-      "readonly": false
+      "driver": "postgres"
     }
   ]
 }

docs-site/content/docs/integrations/context-sources.mdx

@@ -23,7 +23,6 @@ Agents should configure and ingest context sources in this order:
 | Field | Required | Description |
 |-------|----------|-------------|
 | `driver` | Yes | Source adapter: `dbt`, `metricflow`, `lookml`, `metabase`, `looker`, or `notion` |
-| `readonly` | Strongly recommended | Marks the source as read-only for KTX |
 | `source_dir` | For local file sources | Absolute or project-relative source directory |
 | `repo_url` | For Git-hosted sources | Git repository URL |
 | `branch` | No | Git branch to read |
@@ -49,7 +48,6 @@ connections:
   my-dbt:
     driver: dbt
     source_dir: /path/to/dbt/project
-    readonly: true
 ```
 
 For a Git-hosted project:
@@ -62,7 +60,6 @@ connections:
     branch: main
     path: analytics/dbt          # For monorepos
     auth_token_ref: env:GITHUB_TOKEN
-    readonly: true
 ```
 
 ### Authentication
@@ -110,7 +107,6 @@ connections:
       branch: main
       path: dbt_metrics           # Subdirectory for monorepos
       auth_token_ref: env:GITHUB_TOKEN
-    readonly: true
 ```
 
 For a local path:
@@ -157,7 +153,6 @@ connections:
     branch: main
     path: analytics                # Subdirectory for monorepos
     auth_token_ref: env:GITHUB_TOKEN
-    readonly: true
 ```
 
 For a local path:
@@ -219,7 +214,6 @@ connections:
       syncEnabled:
         "3": true
       syncMode: ONLY               # Only ingest mapped databases
-    readonly: true
 ```
 
 ### Authentication
@@ -276,7 +270,6 @@ connections:
     mappings:
       connectionMappings:
         postgres_connection: postgres-main   # Looker conn → KTX conn
-    readonly: true
 ```
 
 ### Authentication
@@ -329,7 +322,6 @@ connections:
     crawl_mode: selected_roots
     root_page_ids:
       - "abc123def456..."
-    readonly: true
 ```
 
 For crawling all accessible pages:
@@ -340,7 +332,6 @@ connections:
     driver: notion
     auth_token_ref: env:NOTION_TOKEN
     crawl_mode: all_accessible
-    readonly: true
 ```
 
 ### Authentication

docs-site/content/docs/integrations/primary-sources.mdx

@@ -21,7 +21,6 @@ Agents should prefer environment or file references over literal secrets.
 | `url` | One of the connection methods | URL-style connectors | Database URL, `env:NAME`, or `file:/path/to/secret` |
 | `host`, `port`, `database`, `username`, `password` | One of the connection methods | PostgreSQL, MySQL, ClickHouse, SQL Server | Field-by-field connection values |
 | `schema` or `schemas` | No | schema-aware warehouses | Single schema or list of schemas to scan |
-| `readonly` | Strongly recommended | all primary sources | Marks the connection as read-only in KTX config |
 | `historicSql` | No | supported warehouses | Enables query-history ingestion when the warehouse supports it |
 | `path` | Yes for path-style SQLite | SQLite | Local SQLite database path or `env:NAME` reference |
 
@@ -37,7 +36,6 @@ connections:
     driver: postgres
     url: postgresql://user:password@host:5432/database
     schema: public
-    readonly: true
 ```
 
 Or with individual fields:
@@ -55,7 +53,6 @@ connections:
       - public
       - analytics
     ssl: true
-    readonly: true
 ```
 
 ### Authentication
@@ -123,7 +120,6 @@ connections:
     username: KTX_SERVICE
     password: env:SNOWFLAKE_PASSWORD
     role: ANALYST
-    readonly: true
 ```
 
 For multiple schemas:
@@ -196,7 +192,6 @@ connections:
     credentials_json: file:~/.config/gcloud/bq-service-account.json
     dataset_id: analytics
     location: US
-    readonly: true
 ```
 
 For multiple datasets:
@@ -269,7 +264,6 @@ connections:
   my-clickhouse:
     driver: clickhouse
     url: http://localhost:8123/analytics
-    readonly: true
 ```
 
 Or with individual fields:
@@ -284,7 +278,6 @@ connections:
     username: default
     password: env:CH_PASSWORD
     ssl: false
-    readonly: true
 ```
 
 ### Authentication
@@ -328,7 +321,6 @@ connections:
   my-mysql:
     driver: mysql
     url: mysql://user:password@host:3306/database
-    readonly: true
 ```
 
 Or with individual fields:
@@ -343,7 +335,6 @@ connections:
     username: ktx_reader
     password: env:MYSQL_PASSWORD
     ssl: true
-    readonly: true
 ```
 
 ### Authentication
@@ -387,7 +378,6 @@ connections:
   my-sqlserver:
     driver: sqlserver
     url: mssql://user:password@host:1433/database?trustServerCertificate=true
-    readonly: true
 ```
 
 Or with individual fields:
@@ -403,7 +393,6 @@ connections:
     password: env:MSSQL_PASSWORD
     schema: dbo
     trustServerCertificate: true
-    readonly: true
 ```
 
 For multiple schemas:
@@ -455,7 +444,6 @@ connections:
   my-sqlite:
     driver: sqlite
     path: ./data/warehouse.sqlite
-    readonly: true
 ```
 
 Path supports multiple formats: