fix(serve): disable writer maintenance in read-only mode

[saagpatel]

Refs #44.

What changed

• Do not start the writable file watcher for serve --read-only.
• Skip crash-temp cleanup and orphan-row reconciliation in read-only mode.
• Warn when vault file mtimes are newer than the indexed file timestamps.
• Add focused tests for stale-index detection and non-mutating reconciliation behavior.

Why

--read-only previously gated write tools but still started a watcher and performed startup maintenance. Multiple read-only servers could independently re-index the same vault and race on the shared SQLite database.

Impact

Read-only servers now observe shared WAL updates without acting as additional writers. They explicitly warn when the index is stale instead of silently self-healing it.

Scope note: this PR stops watcher and reconciliation writes. Store::open still performs the repository's normal SQLite initialization, so this does not claim a byte-level read-only database connection.

Validation

• cargo fmt --check
• cargo clippy -- -D warnings
• cargo test --lib serve::tests::read_only — 2 passed

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8ef1008c43

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Compare staleness per file, not by the newest index row

When an unrelated file is indexed after a stale external edit, this global max(indexed_at) can hide the stale file: e.g. full index at t=100, note A edited externally at t=200, then note B is reindexed/written at t=300, so latest_indexed_at is 300 and the read-only startup returns None even though note A is stale. Since read-only mode now disables the watcher, this path no longer self-heals; the check needs to compare each file record to its corresponding disk mtime/hash (or otherwise run a read-only diff) instead of using the newest indexed row as a vault-wide freshness marker.

Useful? React with 👍 / 👎.