fix(device-core): allow workspace reads in readonly transactions

device-plane/services/device-control-core/test/project-query-repository.test.mjs

@@ -81,6 +81,19 @@ test("project workspace returns only masked identity projections", async () => {
   assert.equal(serialized.includes("raw-audit-payload"), false);
 });
 
+test("project workspace authorization remains compatible with read-only transactions", async () => {
+  const queries = [];
+  const client = workspaceClient({ queries });
+
+  await getDeviceProjectWorkspace(client, actor, projectId);
+
+  assert.ok(queries.length > 0);
+  assert.equal(
+    queries.some((sql) => /\bfor\s+(?:no\s+key\s+)?(?:update|share)\b/i.test(sql)),
+    false,
+  );
+});
+
 test("project read source never selects identifier digests or credential refs", async () => {
   const source = await readFile(
     new URL("../src/project-query-repository.mjs", import.meta.url),
@@ -93,10 +106,11 @@ test("project read source never selects identifier digests or credential refs",
   assert.doesNotMatch(source, /\b(?:dae\.payload|dcr\.configuration)\b/);
 });
 
-function workspaceClient() {
+function workspaceClient({ queries = [] } = {}) {
   let grantReads = 0;
   return {
     async query(sql) {
+      queries.push(sql);
       if (/from device_projects p/.test(sql)) {
         return { rows: [projectGrantRow()] };
       }