Connections are explicit RhoDuckDbConn values. Queries and statements
return tasks through the generic SQL API declared in rho.bio.
rho_check_readonly_sql() is intentionally conservative and is not a
substitute for the parser-backed guard required before accepting untrusted
SQL. It returns a typed RhoSqlAccepted or RhoSqlRejected value. Database
failures resolve to RhoDuckDbErrorValue rather than aborting the task.