fix: fence deferred compatibility writes

hub_core/runtime/compat.py

@@ -453,6 +453,12 @@ def create_compatibility_router() -> APIRouter:
             await _protected(request, "deferred", authorization)
             return {"data": []}
 
+        async def accept_deferred(
+            request: Request, authorization: AuthorizationHeader = None
+        ) -> dict:
+            await _protected(request, "deferred", authorization, write=True)
+            return {"data": []}
+
         stem = path.replace("-", "_")
         router.add_api_route(
             f"/api/v2/{path}",
@@ -462,7 +468,7 @@ def create_compatibility_router() -> APIRouter:
         )
         router.add_api_route(
             f"/api/v2/{path}",
-            empty_collection,
+            accept_deferred,
             methods=["POST"],
             status_code=201,
             operation_id=f"compat_create_{stem}_{index}",

tests/test_compatibility.py

@@ -127,4 +127,7 @@ def test_read_only_group_rejects_write(tmp_path) -> None:
 
     assert response.status_code == 503
     assert response.json()["detail"] == "compatibility group is read-only"
+    deferred = client.post("/annotations", headers=HEADERS)
+    assert deferred.status_code == 503
+    assert deferred.json()["detail"] == "compatibility group is read-only"
     asyncio.run(store.aclose())