“In rejecting the safety enhancement, managers twice cited concerns about the “cost and potential (pilot) training impact.”