fix(logging): use live-safe sqlite read-only mode

[TZZheng]

Summary

• remove the unsafe immutable=1 heuristic from live SQLite event-index readers
• open read-only connections with mode=ro and keep PRAGMA query_only=ON around query execution
• add a live-reader regression that observes a later writer commit through the same reader object
• update the services anatomy to describe and cite the live-safe behavior accurately

Validation

• PYTHONPATH=src python -m pytest -q tests/test_services_logging.py — 37 passed
• git diff --check canonical/main...HEAD — passed
• the original independent review found only an inaccurate anatomy line range; the amended commit points to the verified query implementation

Risk

mode=ro keeps filesystem writes disabled while allowing SQLite to observe later commits. The query allowlist and temporary query_only guard remain intact.

Fixes #672