Please describe the problem in your own words.

The remote.proxy-target.annex-readonly configuration does not prevent modifications to the proxy-target remote if it is accessed via a proxy.

What steps will reproduce the problem?

#!/usr/bin/env bash
set -euxo pipefail

# Set up an empty proxy target repository
mkdir target
cd target
git init
git annex init
cd ..

# Set up the proxying repository
mkdir proxy
cd proxy
git init
git annex init
echo test0 > test0.txt
git annex add .
git commit -m commit
# Add proxy target remote, make it readonly, and enable proxying
git remote add target ../target
git config remote.target.annex-readonly true
git config remote.target.annex-proxy true
git annex updateproxy
# Check that the readonly configuration is effective
set +e
git annex move --to target
set -e
cd ..

# Make a clone of the proxying repository
git clone ssh://$USER@localhost$PWD/proxy clone
cd clone
git annex init
# Add some new annexed content
echo test1 > test1.txt
echo test2 > test2.txt
git annex add .
git commit -m commit2
# Modify the proxy target, even though it is configured to be readonly
git annex move --to origin-target
git annex move --from origin-target
cd ..

What version of git-annex are you using? On what operating system?

$ git annex version
git-annex version: 10.20261026-g351f69fa638bde0d2f68ee5b8bab109c75945331
build flags: Assistant Webapp Inotify TorrentParser MagicMime Benchmark Feeds Testsuite S3 WebDAV Servant OsPath Blake3 XXH3 TastyTap
dependency versions: aws-0.25.2 bloomfilter-2.0.1.3 crypton-1.0.6 DAV-1.3.4 feed-1.3.2.1 ghc-9.10.3 http-client-0.7.19 torrent-10000.1.3 uuid-1.3.16.1 yesod-1.6.2.3
key/value backends: SHA256E SHA256 SHA512E SHA512 SHA224E SHA224 SHA384E SHA384 SHA3_256E SHA3_256 SHA3_512E SHA3_512 SHA3_224E SHA3_224 SHA3_384E SHA3_384 SKEIN256E SKEIN256 SKEIN512E SKEIN512 BLAKE2B256E BLAKE2B256 BLAKE2B512E BLAKE2B512 BLAKE2B160E BLAKE2B160 BLAKE2B224E BLAKE2B224 BLAKE2B384E BLAKE2B384 BLAKE2BP512E BLAKE2BP512 BLAKE2S256E BLAKE2S256 BLAKE2S160E BLAKE2S160 BLAKE2S224E BLAKE2S224 BLAKE2SP256E BLAKE2SP256 BLAKE2SP224E BLAKE2SP224 BLAKE3_256E BLAKE3_256 XXH3E XXH3 SHA1E SHA1 MD5E MD5 WORM URL GITBUNDLE GITMANIFEST VURL X*
remote types: git gcrypt p2p S3 bup directory rsync web bittorrent webdav adb tahoe glacier ddar git-lfs httpalso borg rclone hook external compute mask
operating system: linux x86_64
supported repository versions: 8 9 10
upgrade supported from repository versions: 0 1 2 3 4 5 6 7 8 9 10

Please provide any additional information below.

# If you can, paste a complete transcript of the problem occurring here.
# If the problem is with the git-annex assistant, paste in .git/annex/daemon.log

$ ./reproducer.bash 
+ mkdir target
+ cd target
+ git init
Leeres Git-Repository in /home/icg149/Playground/proxy-readonly/target/.git/ initialisiert
+ git annex init
init  ok
(recording state in git...)
+ cd ..
+ mkdir proxy
+ cd proxy
+ git init
Leeres Git-Repository in /home/icg149/Playground/proxy-readonly/proxy/.git/ initialisiert
+ git annex init
init  ok
(recording state in git...)
+ echo test0
+ git annex add .
add test0.txt 
ok                                
(recording state in git...)
+ git commit -m commit
[main (Root-Commit) 27cd0ae] commit
 1 file changed, 1 insertion(+)
 create mode 120000 test0.txt
+ git remote add target ../target
+ git config remote.target.annex-readonly true
+ git config remote.target.annex-proxy true
+ git annex updateproxy
Started proxying for target
+ set +e
+ git annex move --to target
move test0.txt (to target...) 
  this remote is readonly
failed
move: 1 failed
+ set -e
+ cd ..
+ git clone ssh://icg149@localhost/home/icg149/Playground/proxy-readonly/proxy clone
Klone nach 'clone'...
remote: Objekte aufzählen: 16, fertig.
remote: Zähle Objekte: 100% (16/16), fertig.
remote: Komprimiere Objekte: 100% (12/12), fertig.
remote: Gesamt 16 (Delta 2), Wiederverwendet 0 (Delta 0), Paket wiederverwendet 0 (von 0)
Empfange Objekte: 100% (16/16), fertig.
Löse Unterschiede auf: 100% (2/2), fertig.
+ cd clone
+ git annex init
init  ok
(recording state in git...)
+ echo test1
+ echo test2
+ git annex add .
add test1.txt 
ok                                
add test2.txt 
ok                                
(recording state in git...)
+ git commit -m commit2
[main 6a46897] commit2
 2 files changed, 2 insertions(+)
 create mode 120000 test1.txt
 create mode 120000 test2.txt
+ git annex move --to origin-target
move test1.txt (to origin-target...) 
ok                                
move test2.txt (to origin-target...) 
ok                                
(recording state in git...)
+ git annex move --from origin-target
move test1.txt (from origin-target...) 
ok                                
move test2.txt (from origin-target...) 
ok                                
(recording state in git...)
+ cd ..

# End of transcript or log.

Have you had any luck using git-annex before? (Sometimes we get tired of reading bug reports all day and a lil' positive end note does wonders)