fix(ci): classify organization API access denials safely

Report documented operation, scope and exposure error codes, permitted exposure enums and proxy challenge indicators during deployment checks. Exclude arbitrary upstream messages and credential material while retaining failure on denied access.

Validation: source checks and 123 tests pass. Retried staging run 227194 still returns org_context_http_403; the new diagnostic requires the user-managed push before a further run.

scripts/verify-org-context.mjs

@@ -3,6 +3,32 @@ import { deploymentOrgSettings } from './org-context-settings.mjs';
 import { setTimeout as wait } from 'node:timers/promises';
 import { pathToFileURL } from 'node:url';
 
+// Only documented machine codes and enum values may be copied from an upstream error.
+const accessErrorCodes = new Set([
+  'credential_operation_not_available', 'credential_operation_mismatch',
+  'credential_scope_exceeded', 'credential_exposure_exceeded',
+  'integration_credential_not_allowed', 'integration_credential_required',
+  'invalid_integration_credential', 'integration_credential_expired', 'credential_conflict'
+]);
+const exposures = new Set(['none', 'structure', 'members', 'identifiers']);
+
+async function accessResponseDiagnostic(response) {
+  const type = response.headers.get('content-type') || '';
+  const responseKind = /json/i.test(type) ? 'json' : /html/i.test(type) ? 'html' : 'other';
+  let body;
+  if (responseKind === 'json') {
+    try { body = await response.clone().json(); } catch {}
+  }
+  const code = body?.code || body?.error;
+  return {
+    responseKind,
+    upstreamCode: accessErrorCodes.has(code) ? code : 'unrecognized',
+    grantedExposure: exposures.has(body?.details?.grantedExposure) ? body.details.grantedExposure : undefined,
+    requiredExposure: exposures.has(body?.details?.requiredExposure) ? body.details.requiredExposure : undefined,
+    proxyChallenge: response.headers.get('cf-mitigated') === 'challenge'
+  };
+}
+
 export async function verifyOrganization(env = process.env, { fetchImpl = fetch, pause = wait, log = console.log } = {}) {
   const { vars, secrets } = deploymentOrgSettings(env);
   if (vars.ORG_CONTEXT_ENABLED !== 'true') {
@@ -17,7 +43,8 @@ export async function verifyOrganization(env = process.env, { fetchImpl = fetch,
         status: 'organization_access_denied', httpStatus: response.status,
         endpoint: request.origin + request.pathname,
         tenantId: request.searchParams.get('tenantId'),
-        operation: 'baron.org-context.read', exposure: 'identifiers'
+        operation: 'baron.org-context.read', exposure: 'identifiers',
+        ...await accessResponseDiagnostic(response)
       }));
     }
     return response;