Diagnose: billing account is not open / billingNotEnabled

Symptoms: GCS "403 Account Disabled", BigQuery "billingNotEnabled 403", or "The billing account for the owning project is not open".

Cause: the project has no open billing account. Never linked, or the linked account was closed. Not IAM, not quotas.

Confirm:
1. `gcloud billing projects describe [P]` - shows billingEnabled false or no account.
2. In the console, Billing for the project shows no linked account or a closed one.
3. If it worked before and broke now: check whether the billing account was closed or the free-tier allowance ran out. "Worked yesterday" points at the account, not the project.

Fix:
```
gcloud billing projects link [P] --billing-account [ACCOUNT-ID]
```
Then rerun. No code or IAM changes needed.

After fixing, do the cost hygiene you skipped:
- Create a budget with alert thresholds on the billing account before running anything expensive.
- For BigQuery, dry-run big queries first (check total_bytes_processed).
- For GCS, remember storage, operations, and egress all bill; lifecycle policies cut storage cost.

Agent trap: provisioning scripts that create the project but never link billing, then fail at the first real resource. Link billing in the same script, right after project creation, and assert billingEnabled before proceeding.

Verify: describe shows billingEnabled true, then the original operation succeeds.