fix(backend): add prompt guardrails from feedback

[alexinthesky]

Summary

Tightens the default system prompt to fix three recurring complaints from the internal Ask O11y feedback round. All changes are in DefaultSystemPrompt; /api/prompt-defaults returns this constant directly, so the config UI stays in sync (no route/OpenAPI change). Provisioned custom prompts intentionally don't inherit these.

• No unprompted writes — default to read-only investigation; propose and confirm before creating/modifying/deleting any resource (alerts, dashboards, silences, rules, annotations).
• Capability honesty — only claim capabilities backed by an available tool; say so plainly when something is unsupported instead of inventing a workflow.
• Honor user-specified time ranges — use exactly the range the user names, no silent fallback to a default window.

Testing

• go test ./pkg/... ✅ (extended prompts_test.go to assert all three guardrails appear in the assembled prompt)

🤖 Generated with Claude Code

---

Note

Low Risk
Changes are limited to default prompt text, a unit test, and CI action SHA pins; no auth, data paths, or API contract changes.

Overview
Strengthens the default Ask O11y system prompt (DefaultSystemPrompt) to address recurring feedback: mutating Grafana resources only when the user explicitly asks (otherwise propose and confirm), a new capability honesty rule in the anti-hallucination contract, and strict use of user-specified time ranges without silent defaults.

Adds TestBuildSystemPrompt_FeedbackGuardrailsPresent so the assembled prompt always includes those three snippets. Custom provisioned prompts still override via settings and do not pick up these defaults automatically; /api/prompt-defaults continues to serve the updated constant.

CI pins grafana/plugin-actions wait-for-grafana and is-compatible to commit 2ecc2ba… instead of @main.

^{Reviewed by Cursor Bugbot for commit 243444e. Bugbot is set up for automated code reviews on this repo. Configure here.}