CE-1007: offline validate fails thrash grants binds

[btipling]

Summary

• OfflineValidate hard-fails thrash grants bind forms: bare $N, hybrid $N<path>, dotted ?<a.b>
• Grants ?<name> expansion dry-run with synthetic parent (no DB)
• Unit tests for thrash reject / D1 accept / D2 skip_if / unknown token

Context

Customer-bar slice for CE-1007 / c1#21984. No dialect change; placeholder grammar unchanged.

Test plan

• go test ./pkg/bsql/ -run OfflineValidate
• CI green

[linear-code]

CE-1007

[github-actions]

🟡 Suggestion: bareDollarParamRegex (\$[0-9]+) scans the entire grants query string, so it also matches $N sequences inside string literals or Postgres dollar-quoted bodies (e.g. regexp_replace(col, '(x)', '$1') or a $1$-tagged block). A grants query using those forms would be rejected even though it contains no real bind placeholder. Low confidence since such patterns are uncommon in grants queries, but worth considering if false rejections surface.

[github-actions]

Connector PR Review: CE-1007: offline validate fails thrash grants binds

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base f45ad4c70e3a.
Review mode: full
View review run: https://github.com/ConductorOne/baton-sql/actions/runs/30416361914

Review Summary
Scanned the full PR diff for security and correctness. The change adds offline validation that hard-fails thrash grant bind forms (bare $N, hybrid $N<path>, dotted ?<a.b>) and dry-runs ?<name> expansion against a synthetic parent resource without a DB. The bind dry-run correctly reuses queryVars/PrepareQueryVars/parseQueryOpts, skips pagination-only tokens, and the synthetic SQLSyncer sets only dbEngine/env — no nil-pointer risk in the reused helpers. Tests cover reject of bare/hybrid/dotted forms, accept of D1 bind and D2 skip_if, and the unknown-token case. No blocking issues found.

Security Issues
None found.

Correctness Issues
None found.

Suggestions

• pkg/bsql/offline_validate.go:21 — bareDollarParamRegex scans the whole grants query, so $N inside string literals or Postgres dollar-quoted bodies could trigger a false rejection (low confidence).

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

Suggestions:

In pkg/bsql/offline_validate.go:
- Around line 21 (bareDollarParamRegex) and its use at line 108: the regex matching bare
  dollar placeholders is applied against the entire grants query string, so it also
  matches dollar-number sequences that appear inside SQL string literals or Postgres
  dollar-quoted bodies (for example regexp_replace using a dollar-1 backreference, or a
  dollar-tagged block). Such a grants query would be rejected as a thrash bind even
  though it has no real placeholder. If false rejections become a concern, narrow the
  detection to placeholder-position contexts rather than a bare substring scan.

[github-actions]

No blocking issues found.