Run read-only work against one database snapshot.

The transaction begins READ ONLY, so it never takes the write lock and never blocks a writer; every statement it sees is one snapshot of the data, however many round trips the work makes. Statements must be SELECTs — a write smuggled into the scope throws before it reaches the database. The snapshot never commits: it ends by closing; cache invalidation does not apply because nothing was written. An upstream failure replays the whole attempt on a fresh transaction, so work must be safe to run twice, as with withTransaction.