Recognise VALUES and leading-paren forms as row-returning

_is_row_returning previously missed two valid top-level SQLite
statements: ``VALUES (...)`` and ``(SELECT ...)``. Both produce result
sets but took the DML branch, so the cursor called the non-query path
and returned no rows. Add VALUES to the prefix tuple and strip a
single leading ``(`` before matching so wrapped-select forms are
classified correctly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: antoineleclair

src/dqlitedbapi/cursor.py

@@ -144,21 +144,25 @@ def _strip_leading_comments(sql: str) -> str:
     return s
 
 
-_ROW_RETURNING_PREFIXES = ("SELECT", "PRAGMA", "EXPLAIN", "WITH")
+_ROW_RETURNING_PREFIXES = ("SELECT", "VALUES", "PRAGMA", "EXPLAIN", "WITH")
 
 
 def _is_row_returning(sql: str) -> bool:
     """Heuristic for "does this statement return a result set?"
 
     Single source of truth for sync and async cursors.
-    Matches leading SELECT/PRAGMA/EXPLAIN/WITH after stripping comments,
-    and catches trailing/embedded RETURNING clauses on DML.
+    Matches leading SELECT/VALUES/PRAGMA/EXPLAIN/WITH after stripping
+    comments and a single leading ``(``, and catches trailing or
+    embedded RETURNING clauses on DML.
+
+    ``VALUES (...)`` and ``(SELECT ...)`` are valid top-level
+    row-returning SQLite statements, so they take the query branch.
 
     Note: ``WITH ... INSERT/UPDATE/DELETE`` (no RETURNING) will be
     misclassified as a query. This is a known limitation of a
     prefix-only check — a full SQL parser is out of scope.
     """
-    normalized = _strip_leading_comments(sql).upper()
+    normalized = _strip_leading_comments(sql).upper().lstrip("(")
     if normalized.startswith(_ROW_RETURNING_PREFIXES):
         return True
     return " RETURNING " in normalized or normalized.endswith(" RETURNING")

tests/test_dbapi_hardening.py

@@ -324,6 +324,13 @@ class TestIsRowReturning:
             "WITH cte AS (SELECT 1) SELECT * FROM cte",
             "INSERT INTO t VALUES (?) RETURNING id",
             "UPDATE t SET x = 1 WHERE id = ? RETURNING *",
+            # VALUES (...) is a valid top-level row-returning SQLite statement.
+            "VALUES (1), (2), (3)",
+            "values (1, 'a')",
+            "  -- preamble\nVALUES (1)",
+            # Leading paren on a row-returning form.
+            "(SELECT 1)",
+            "(SELECT a FROM t) UNION (SELECT b FROM u)",
         ],
     )
     def test_detects_row_returning(self, sql: str) -> None: