Translations:Manual:$wgReadOnly/21/en

A simple solution is to set it to read only when not running from the command line, which will not affect the command line update script: