Remaining commands still create an empty graph.db on first run; released-version poisoned graphs are not auto-healed (follow-up to #777 / #782)

PR #782 (merged) made status read-only on missing graphs and made update force a full rebuild when the graph is missing or empty. Two verified gaps remain from that review:

1. detect-changes, visualize, wiki, and watch still create an empty graph.db (with full schema) on a repo with no graph, the same side-effect class #777 reported for status. Mitigated today because update self-heals empty graphs, but the commands should resolve the DB path read-only like status now does.

2. Graphs already poisoned by released versions are not auto-healed: the new has_nodes guard only repairs missing or zero-node graphs. A graph that got a partial diff-only build with a synced head (non-empty but incomplete) still updates incrementally forever. Affected users need a documented recovery (build --force) or a heuristic (for example, indexed-file count much lower than tracked-file count) to trigger a rebuild.