ai-enhance: enforce BigQuery cost guard

[arsalann]

Summary

• Add a deterministic BigQuery cost-guard preflight to bruin ai enhance before any AI work begins.
• Resolve every BigQuery asset in scope to its configured connection and verify at least one of max_query_cost, max_query_cost_soft, max_billable_bytes, or max_billable_bytes_soft is configured.
• Prompt interactive users for a positive per-query USD cap when a connection lacks a guard; Enter or skip, and all non-interactive runs, apply and persist the safe $5.00 default.
• Add focused coverage for connection detection, guard handling, prompt validation, persistence, and non-interactive behavior.
• Document the preflight behavior and supported limits.

Why

Prompt-only instructions cannot reliably prevent an AI workflow from issuing unbounded BigQuery queries. Enforcing the guard in the command makes the safety check deterministic and persists the selected limit for future runs.

Validation

• make format
• make test
• Docs site served locally; the updated command page loaded successfully.

Notes

• The guard is intentionally limited to BigQuery because Bruin cost-limit configuration currently applies there.
• Existing GitHub CI checks (test, lint, documentation build, Docker build, and end-to-end) are passing.

[greptile-apps]

Comments Outside Diff (1)

1. pkg/enhance/prompt.go, line 1-38 (link)

   No test coverage for the new cost-safety content

   prompt_test.go does not assert that the new section is present in the built prompt. Given that cost-guard enforcement is safety-critical, a test case verifying that key phrases (e.g., "max_query_cost", "--dry-run", "Query Cost Safety") appear in the output of BuildEnhancePrompt would prevent a future accidental deletion or truncation from going unnoticed.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: pkg/enhance/prompt.go
   Line: 1-38
   
   Comment:
   **No test coverage for the new cost-safety content**
   
   `prompt_test.go` does not assert that the new section is present in the built prompt. Given that cost-guard enforcement is safety-critical, a test case verifying that key phrases (e.g., `"max_query_cost"`, `"--dry-run"`, `"Query Cost Safety"`) appear in the output of `BuildEnhancePrompt` would prevent a future accidental deletion or truncation from going unnoticed.
   
   How can I resolve this? If you propose a fix, please make it concise.

Prompt To Fix All With AI

Fix the following 3 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 3
pkg/enhance/prompt.go:155-156
**Missing asset-to-connection resolution step**

The instructions jump straight to inspecting `.bruin.yml` without first telling the agent to read the asset file and extract its `connection` field. Without that step, the agent has no concrete connection name to look up — it may scan all `google_cloud_platform` connections or silently pick the first one, both of which can result in evaluating the wrong limits.

The instructions should begin with: read the asset file at `<asset-path>`, extract the value of its `connection` field (falling back to the pipeline default if unset), then look that name up in `.bruin.yml`.

### Issue 2 of 3
pkg/enhance/prompt.go:151-169
**Cost safety section placed after the modification and validation steps**

The "Context Discovery" section (step 1) already encourages the agent to read SQL queries and run tools to understand the asset. If the agent decides to issue a `bruin query` call during that discovery phase, it will have already planned that action before reaching this safety section — which appears as the very last substantive block in the prompt.

Placing this guard immediately after the "Context Discovery" section (or at least before "Asset Description Requirements") would make it a precondition the agent evaluates before any query is planned, not a post-hoc rule it reads after the fact.

### Issue 3 of 3
pkg/enhance/prompt.go:1-38
**No test coverage for the new cost-safety content**

`prompt_test.go` does not assert that the new section is present in the built prompt. Given that cost-guard enforcement is safety-critical, a test case verifying that key phrases (e.g., `"max_query_cost"`, `"--dry-run"`, `"Query Cost Safety"`) appear in the output of `BuildEnhancePrompt` would prevent a future accidental deletion or truncation from going unnoticed.

_{Reviews (1): Last reviewed commit: "docs(ai-enhance): document BigQuery cost..." | Re-trigger Greptile}