feat: add --readonly flag for worker sandboxes (gt-ymo)

Add a --readonly flag that blocks all write operations, allowing workers
to read beads state without modifying it. Workers can use:
- bd show, bd list, bd ready (read operations)

Workers cannot use:
- bd create, bd update, bd close, bd sync, etc. (write operations)

The flag can be set via:
- --readonly flag on command line
- BD_READONLY=true environment variable
- readonly: true in config file

This enables swarm workers to see their assigned work from a static
snapshot of the beads database without accidentally modifying it.

Commands protected by readonly mode:
- create, update, close, delete, edit
- sync, import, reopen
- comment add, dep add/remove, label add/remove
- repair-deps, compact, migrate, migrate-hash-ids, migrate-issues
- rename-prefix, validate --fix-all, duplicates --auto-merge
- epic close-eligible, jira sync

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

cmd/bd/duplicates.go

@@ -22,14 +22,18 @@ Example:
   bd duplicates --auto-merge       # Automatically merge all duplicates
   bd duplicates --dry-run          # Show what would be merged`,
 	Run: func(cmd *cobra.Command, _ []string) {
+		autoMerge, _ := cmd.Flags().GetBool("auto-merge")
+		dryRun, _ := cmd.Flags().GetBool("dry-run")
+		// Block writes in readonly mode (merging modifies data)
+		if autoMerge && !dryRun {
+			CheckReadonly("duplicates --auto-merge")
+		}
 		// Check daemon mode - not supported yet (merge command limitation)
 		if daemonClient != nil {
 			fmt.Fprintf(os.Stderr, "Error: duplicates command not yet supported in daemon mode (see bd-190)\n")
 			fmt.Fprintf(os.Stderr, "Use: bd --no-daemon duplicates\n")
 			os.Exit(1)
 		}
-		autoMerge, _ := cmd.Flags().GetBool("auto-merge")
-		dryRun, _ := cmd.Flags().GetBool("dry-run")
 		// Use global jsonOutput set by PersistentPreRun
 		ctx := rootCtx