fix: address pre-release review findings for v0.5.15 (#580)

* fix: address pre-release review findings — dead code, undefined guards, driver tests, docs

- Remove duplicate `altimate_change end` markers in `prompt.ts`
- Replace `password: "secret"` with `"test-fake-password"` in test fixtures
- Fix `classifySkillTrigger()` to return `"unknown"` for unexpected triggers
- Remove unused `"schema_not_indexed"` from `feature_suggestion` type
- Add null guards in `sql-translate`, `dbt-manifest`, `dbt-lineage`,
  `column-lineage`, `track-lineage` to prevent literal "undefined" display
- Propagate `result.error` to metadata in `dbt-manifest`
- Add 24 driver security tests (DuckDB retry, MongoDB blocking,
  PG/Redshift validation, registry unsupported DB hints)
- Document DuckDB concurrent access, MongoDB blocked operators,
  unsupported databases in `warehouses.md`

Closes #579

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: restore missing `altimate_change end` markers and update test expectations

- Add back `// altimate_change end — session start telemetry` and
  `// altimate_change end — accumulate session metrics` markers
  (the removed duplicates were actually balancing real start blocks)
- Update `classifySkillTrigger` tests to expect `"unknown"` for
  unrecognized/missing trigger values (matches the behavior fix)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: anandgupta42

docs/docs/configure/warehouses.md

@@ -211,6 +211,9 @@ If you're already authenticated via `gcloud`, omit `credentials_path`:
 |-------|----------|-------------|
 | `path` | No | Database file path. Omit or use `":memory:"` for in-memory |
 
+!!! note "Concurrent access"
+    DuckDB does not support concurrent write access to the same file. If another process holds a write lock, Altimate Code automatically retries the connection in **read-only** mode so you can still query the data. A clear error message is shown if read-only access also fails.
+
 ## MySQL
 
 ```json
@@ -279,6 +282,9 @@ If you're already authenticated via `gcloud`, omit `credentials_path`:
 !!! note
     MongoDB uses MQL (MongoDB Query Language) instead of SQL. Queries are submitted as JSON objects via the `execute` method. Supported commands: `find`, `aggregate`, `countDocuments`, `distinct`, `insertOne`, `insertMany`, `updateOne`, `updateMany`, `deleteOne`, `deleteMany`, `createIndex`, `listIndexes`, `createCollection`, `dropCollection`, `ping`.
 
+!!! warning "Blocked operators"
+    For safety, aggregate pipelines block `$out` and `$merge` (write stages) and `$function` and `$accumulator` (arbitrary JavaScript execution). Use `find`, `countDocuments`, or safe aggregate stages for read-only analysis.
+
 !!! info "Server compatibility"
     The MongoDB driver (v6.x) supports MongoDB server versions 3.6 through 8.0, covering all releases from the last 3+ years.
 
@@ -308,6 +314,17 @@ If you're already authenticated via `gcloud`, omit `credentials_path`:
 | `azure_auth` | No | Use Azure AD authentication (default: `false`) |
 | `trust_server_certificate` | No | Trust server certificate without validation (default: `false`) |
 
+## Unsupported Databases
+
+The following databases are not yet natively supported, but workarounds are available:
+
+| Database | Workaround |
+|----------|------------|
+| ClickHouse | Use the bash tool with `clickhouse-client` or `curl` to query directly |
+| Cassandra | Use the bash tool with `cqlsh` to query directly |
+| CockroachDB | PostgreSQL-compatible — use `type: postgres` |
+| TimescaleDB | PostgreSQL extension — use `type: postgres` |
+
 ## SSH Tunneling
 
 All warehouse types support SSH tunneling for connections behind a bastion host: