Five Questions Before You Let an AI Agent Touch Your Codebase