ai-enhance: respect BigQuery cost guards in agent prompt

[arsalann]

Summary

• Adds a ## Query Cost Safety (BigQuery only) section to the bruin ai-enhance system prompt (pkg/enhance/prompt.go).
• Instructs the agent to inspect .bruin.yml for max_query_cost / max_query_cost_soft / max_billable_bytes / max_billable_bytes_soft on the asset's google_cloud_platform connection before issuing any query.
• If a limit is set: always bruin query --dry-run first, rewrite if the estimate exceeds the limit, and never pass --dangerously-bypass-soft-limits without explicit user confirmation.
• If no limit is set: stop, warn the user that cost is uncapped, offer to add one, and require an explicit acknowledgement before proceeding.
• Scope is explicitly BigQuery-only; other warehouses are called out as not currently supporting Bruin cost guards.

No changes to BigQuery enforcement code or the enhance command itself — prompt-only update.

Test plan

• make format — clean (golangci-lint not installed locally; unrelated)
• make test — full unit suite passes, including pkg/enhance (TestBuildEnhancePrompt)
• Manual smoke: run bruin ai-enhance <bq-asset> against a pipeline with (a) no cost guard configured and (b) a max_query_cost_soft configured; confirm the agent surfaces the no-limit warning in (a) and dry-runs before querying in (b)

[greptile-apps]

Comments Outside Diff (1)

1. pkg/enhance/prompt.go, line 1-38 (link)

   No test coverage for the new cost-safety content

   prompt_test.go does not assert that the new section is present in the built prompt. Given that cost-guard enforcement is safety-critical, a test case verifying that key phrases (e.g., "max_query_cost", "--dry-run", "Query Cost Safety") appear in the output of BuildEnhancePrompt would prevent a future accidental deletion or truncation from going unnoticed.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: pkg/enhance/prompt.go
   Line: 1-38
   
   Comment:
   **No test coverage for the new cost-safety content**
   
   `prompt_test.go` does not assert that the new section is present in the built prompt. Given that cost-guard enforcement is safety-critical, a test case verifying that key phrases (e.g., `"max_query_cost"`, `"--dry-run"`, `"Query Cost Safety"`) appear in the output of `BuildEnhancePrompt` would prevent a future accidental deletion or truncation from going unnoticed.
   
   How can I resolve this? If you propose a fix, please make it concise.

Prompt To Fix All With AI

Fix the following 3 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 3
pkg/enhance/prompt.go:155-156
**Missing asset-to-connection resolution step**

The instructions jump straight to inspecting `.bruin.yml` without first telling the agent to read the asset file and extract its `connection` field. Without that step, the agent has no concrete connection name to look up — it may scan all `google_cloud_platform` connections or silently pick the first one, both of which can result in evaluating the wrong limits.

The instructions should begin with: read the asset file at `<asset-path>`, extract the value of its `connection` field (falling back to the pipeline default if unset), then look that name up in `.bruin.yml`.

### Issue 2 of 3
pkg/enhance/prompt.go:151-169
**Cost safety section placed after the modification and validation steps**

The "Context Discovery" section (step 1) already encourages the agent to read SQL queries and run tools to understand the asset. If the agent decides to issue a `bruin query` call during that discovery phase, it will have already planned that action before reaching this safety section — which appears as the very last substantive block in the prompt.

Placing this guard immediately after the "Context Discovery" section (or at least before "Asset Description Requirements") would make it a precondition the agent evaluates before any query is planned, not a post-hoc rule it reads after the fact.

### Issue 3 of 3
pkg/enhance/prompt.go:1-38
**No test coverage for the new cost-safety content**

`prompt_test.go` does not assert that the new section is present in the built prompt. Given that cost-guard enforcement is safety-critical, a test case verifying that key phrases (e.g., `"max_query_cost"`, `"--dry-run"`, `"Query Cost Safety"`) appear in the output of `BuildEnhancePrompt` would prevent a future accidental deletion or truncation from going unnoticed.

_{Reviews (1): Last reviewed commit: "docs(ai-enhance): document BigQuery cost..." | Re-trigger Greptile}