fix: a select-only SQLRT session declines a non-select before running it

[TonyStack2026]

Stack note

Head branch is tony/em-mcqa-instance-tunnel (PR #8, which is on top of #6) plus one commit,
so three commits show here until #6/#8 land and this collapses to one.

The bug

Driving the published driver (odps-jdbc 3.10.13 from Maven Central) with
interactiveMode=mcqa&useInstanceTunnel=true against the #6/#8 stack applied every write
statement twice. One insert into ... values (1,'one'),(2,'two'),(3,'three') gave
count(*) = 6.

The request sequence, captured with a logging proxy:

1. PUT .../instances/{session}?info (Key=query) — the session executes the DDL/DML, queryId 1.
2. GET .../instances/{session}?data&cached&queryid=1 — the tunnel read answers
   400 InstanceTypeNotSupported / Non select query not supported, which is what feat: download an MCQA sub query's result over the instance tunnel #8 added and
   what the service says.
3. POST /projects/{p}/instances — the driver reruns the same statement offline. That is the
   documented reaction, not a workaround: SQLExecutorImpl#getSessionResultSetByInstanceTunnel
   catches TunnelRetryStatus.NON_SELECT_QUERY and calls
   runQueryInternal(ExecuteMode.OFFLINE, retryInfo.errMsg, true).

Step 2 is only a refusal of the download. By then the side effect has already happened in
step 1, so the rerun in step 3 lands on top of it. A session that executes a non-select and
then says it cannot hand back its result is the wrong order: the client can only ever be told
once, and it will act on that by running the statement itself.

The change

A SQLRT session declines a non-select before starting it, answering the way the client
already expects to be answered:

{"queryId": -1, "status": "ok", "result": "ODPS-1850001 Non select query not supported."}

queryId == -1 with status ok is the branch SQLExecutorImpl#runInSessionWithRetry reads as
"the session would not run this", and ODPS-185 inside the message is the flag
FallbackPolicy#shouldFallback matches when fallbackForUnsupportedFeature is on — which is
what turns the refusal into a single offline run instead of an error. Drop the code and keep
the sentence and clients with fallback disabled get a hard failure they cannot distinguish.

odps.sql.session.select.only lifts it, in the session settings or per statement — the same
key the client sends in the sub-query settings block. Classification looks at every
statement of a submission, comments and quotes stripped, so select 1; drop table t is not a
select.

Evidence

Layer	Check	Result
Go	go test -race -count=1 ./internal/..., go vet, gofmt -l	green / clean
Go (new)	mcqa_select_only_test.go	refusal does not create the table; declines without consuming a sub-query id; select.only=false at either level runs it; statement classification table incl. select ';' as x and multi-statement
Consumer (unchanged behaviour)	tests/java against this binary	McqaSessionTest 6/6, EmulatorTest 26/26, UdfMetadataTest 4/4
Driver, before	mcqa-tunnel-effect on #6+#8	count after one insert statement=6
Driver, after	same probe on #6+#8+this+#9	count after one insert statement=3, still interactiveMode=INTERACTIVE, t1=BIGINT via the tunnel read
Driver, boundary	same probe with disableFallback=true	the refusal surfaces as ODPS-1850001 Non select query not supported. — a client that turned fallback off is told, not silently rerouted

Two tests in #8 (TestMCQADirectDownloadRefusesNonSelect,
TestMCQADirectDownloadLimitedFlagCapsRows) now create their session with
odps.sql.session.select.only=false: they need DDL/DML inside a session to reach the tunnel
layer they pin, which is exactly what the opt-in is for. Their assertions are unchanged.

What this does not claim

• The queryId: -1 + ODPS-185 pair is derived from the client's handling of it (public
  odps-sdk-core), not from a run against a real MCQA session — I have no interactive quota
  here. The driver's double execution is measured; the shape of the answer is the one the
  driver already branches on.
• show/desc-style statements count as "not a select" under this classification and are
  declined. If any of them should stay in-session, that is a follow-up on the keyword rule.
• Session-scoped state isolation is untouched (still not simulated).

[dingxin-tech]

resolve conflict pls

[TonyStack2026]

Closing rather than rebasing: #11 (merged as 700181e) is the corrected replacement — it carries this branch's still-unmerged select-only implementation and additionally classifies writes hidden behind a WITH prefix. git diff origin/main tony/em-session-select-only now only removes #11's stronger mcqa_select_only.go and its tests, so a rebase here would regress main.

Post-merge exit regression against 700181e with the published driver (odps-jdbc:3.10.13): a WITH x AS (SELECT 42 AS id) INSERT … executed in one session run (count=4, the 42 row present exactly once, session still interactive), instance-tunnel reads stayed typed (t1=BIGINT), and tests/java (45/45, includes McqaSessionTest 6/6) and tests/jdbc (3/3) are green against the same Dockerfile-built image (mvn -B -f tests/java/pom.xml -Demulator.image=maxcompute-emulator:ci test against main). Nothing here is lost that #11 did not already cover.