[FEATURE]: Pre-execution cost firewall for warehouse queries

### Feature hasn't been suggested before.

- [x] I have verified this feature I'm about to request hasn't been suggested before.

### Describe the enhancement you want to request

### Problem
The agent can run an analytical query that scans terabytes. e.g. `SELECT * FROM events` and incur a large warehouse bill before anyone realizes. Today there is no pre-execution cost estimate or budget guardrail in `sql_execute`. The FinOps tooling that exists is all *historical* (analyzing spend after the fact), not preventive.

### Proposed enhancement
An opt-in **cost firewall** that estimates a query's scan cost **before** it runs and asks for confirmation when it exceeds a configured budget:

- Estimate via warehouse-native dry-run where available (BigQuery `dryRun` returns exact bytes processed for free; no execution, no cost).
- New `governance` config: `max_query_cost_usd`, `max_bytes_scanned`, `cost_per_tib_usd`.
- When a query is over budget, prompt the user (with a hint to try `sql_optimize` first).
- **Disabled by default**; warehouses without estimation support are unaffected (the guard fails open).

### Benefits
Cost control is core to the data-engineering workflow. A pre-flight guardrail turns a **surprise $40 query** into **approve, or optimize first** without changing behavior for anyone who doesn't set a budget.

### Notes
I have an implementation ready (BigQuery estimator + the default-off guard framework) and can open a PR referencing this issue. The estimator is designed to extend to other warehouses (Snowflake via `EXPLAIN`, etc.).