fix(ai): run_sql reruns misspelt column names and keeps internal SQL out of errors - #1959

🟢 Confidence 10/10 · safe to merge
New guard only declines rewrites, and the added test fails without it; earlier regex edge cases are pinned by behaviour tests.
_{no findings · tests covered · risk low}

run_sql now rewrites an unambiguous misspelt column and reruns, and scrubs internal SQL out of warehouse errors. The change since the last review only adds a guard that declines a qualified fix when its qualifier names two relations, and it is correct.

• fixUnknownIdentifier declines a qualified rewrite when qualifierReused sees the qualifier bound by two relations
• sql-identifiers.test.ts pins the CTE-plus-table qualifier case

_{414492e · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}