feat(connections): add execute-only warehouses; stop silent full-project scans

A configured warehouse was always a scan/ingest target. The only way to use a
connection purely for SQL execution (ktx sql / sql_execution) was the leaky
workaround of an empty setup.database_connection_ids — which actually re-includes
every warehouse via the 'fall back to all' branch — so e.g. a BigQuery connection
meant only for read-only queries triggered a full-billing-project scan.

- Add a per-connection scan_enabled flag (default true) to warehouse connections.
  scan_enabled: false registers the connection for execution only and never as a
  scan target.
- Route every scan-target selection path through one predicate
  (isScanTargetWarehouse): both ingest (primaryWarehouseConnectionIds, including
  the all-warehouses fallback) and setup (configuredPrimaryConnectionIds) now
  exclude execute-only connections. Setup validates the credential but skips
  scope discovery and scan for them. Execution paths are untouched — the warehouse
  descriptor still resolves, so ktx sql / sql_execution keep working.
- Scripted setup with no --database-schema no longer silently scopes the scan to
  every discovered schema/dataset: it warns with the count and names how to narrow
  (--database-schema) or opt out (scan_enabled: false).

packages/cli/test/context/ingest/local-adapters.test.ts

@@ -634,6 +634,21 @@ describe('local ingest adapters', () => {
     await expect(adapter?.listTargetConnectionIds?.('/tmp/staged-dbt')).resolves.toEqual(['warehouse']);
   });
 
+  it('excludes execute-only (scan_enabled: false) warehouses from primary scan targets', async () => {
+    const adapters = createDefaultLocalIngestAdapters(
+      projectWithConnections({
+        scannable: { driver: 'postgres', url: 'postgresql://db/a' },
+        executeonly: { driver: 'postgres', url: 'postgresql://db/b', scan_enabled: false },
+        docs: { driver: 'dbt', source_dir: './dbt' },
+      } as never),
+    );
+
+    // No setup.database_connection_ids → falls back to "all warehouses", which must now
+    // skip the execute-only connection rather than re-including it.
+    const dbt = adapters.find((adapter) => adapter.source === 'dbt');
+    await expect(dbt?.listTargetConnectionIds?.('/tmp/staged-dbt')).resolves.toEqual(['scannable']);
+  });
+
   it('passes primary warehouse connection ids to the local Notion adapter', async () => {
     const adapters = createDefaultLocalIngestAdapters(
       projectWithConnections({