fix(ci): identify denied organization roots in access checks

Log the requested tenant, endpoint, operation and exposure for organization HTTP 401/403 responses. Keep credentials and upstream response bodies out of diagnostics and retain the deployment gate.

Validation: source checks and 118 tests pass, including forbidden-root identification and diagnostic privacy coverage.

scripts/verify-org-context.mjs

@@ -9,10 +9,23 @@ export async function verifyOrganization(env = process.env, { fetchImpl = fetch,
     log('Organization integration disabled; existing behavior retained.');
     return;
   }
+  const checkedFetch = async (url, options) => {
+    const response = await fetchImpl(url, options);
+    if (response.status === 401 || response.status === 403) {
+      const request = new URL(url);
+      log(JSON.stringify({
+        status: 'organization_access_denied', httpStatus: response.status,
+        endpoint: request.origin + request.pathname,
+        tenantId: request.searchParams.get('tenantId'),
+        operation: 'baron.org-context.read', exposure: 'identifiers'
+      }));
+    }
+    return response;
+  };
   for (let attempt = 1; attempt <= 3; attempt++) {
     try {
       // CI can wait for a slow upstream without extending the page request timeout.
-      const directory = await getOrgDirectory({ ...vars, ...secrets }, { fetchImpl, timeoutMs: 15000 });
+      const directory = await getOrgDirectory({ ...vars, ...secrets }, { fetchImpl: checkedFetch, timeoutMs: 15000 });
       const summary = {
         status: 'verified', rootCount: JSON.parse(vars.ORG_CONTEXT_TENANT_IDS).length,
         tenantCount: directory.tenantCount, userCount: directory.byUser.size,