test(llm): pin sandbox-weakening commands and parser edge cases

Extend the read-only query validator's regression suite with 17 more
scenarios lifted from a v2 of the original #10022 patch that was
never committed (recovered from an uncommitted draft).

Five new accept scenarios cover parser corner cases:
  - leading whitespace
  - trailing semicolon followed by trailing whitespace
  - leading line comment
  - semicolon inside a string literal (must not split the statement)
  - (SELECT 1) UNION (SELECT 2), confirming the leading-keyword
    traversal walks past parentheses

Twelve new reject scenarios pin commands that directly attack the
BEGIN TRANSACTION READ ONLY wrapper rather than merely attempting a
generic write:
  - bare COMMIT / END / ROLLBACK / ABORT / BEGIN as single statements
    (previously tested only as the leading verb of a multi-statement
    payload)
  - START TRANSACTION (synonym for BEGIN)
  - SAVEPOINT (savepoint manipulation)
  - SET LOCAL transaction_read_only = off
  - SET SESSION default_transaction_read_only = off
  - DISCARD ALL (resets session state -- search_path, prepared
    statements, etc.)
  - multi-statement payloads where the leading statement is an
    allowed verb (SELECT or WITH) followed by ROLLBACK and a write
    -- closer to a real attack shape than the trailing-COMMIT PoC

If a future refactor of _ALLOWED_LEADING_KEYWORDS or the statement-
counting logic lets any of these slip through, the new scenarios
fail loudly. Module is now 77 passed / 0 failed / 0 skipped.