feat: a key that no longer decrypts a share link says why

By where it lives: a Databricks secret or SOPS value has changed
since the link was made, an Azure secret's current version isn't the
link's (unpinned), and a pinned version can't have changed, so the
link may be damaged. The popup wraps the reason instead of cutting
it; r is for what Key Vault adds to check.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/share/share.go

@@ -203,7 +203,7 @@ func (s Sealed) Open(key []byte) ([]File, error) {
 	if err != nil {
 		var wrong *age.NoIdentityMatchError
 		if errors.As(err, &wrong) {
-			return nil, errors.New("the key doesn't decrypt it: the link may have been made with another version of " + s.Key.Name)
+			return nil, s.wrongKey()
 		}
 		return nil, fmt.Errorf("can't decrypt the link: %w", err)
 	}
@@ -228,6 +228,21 @@ func (s Sealed) Open(key []byte) ([]File, error) {
 	return out, nil
 }
 
+// wrongKey says why the key, read fine, doesn't decrypt the link: its
+// value isn't the one the link was made with.
+func (s Sealed) wrongKey() error {
+	name := s.Key.Name
+	switch {
+	case s.Key.Kind == provider.KindAzure && s.Key.Version != "":
+		// A version's value never changes.
+		return fmt.Errorf("%s at version %s doesn't decrypt it: the link may be damaged", name, s.Key.Version)
+	case s.Key.Kind == provider.KindAzure:
+		return fmt.Errorf("%s's current version isn't the one the link was made with, so it can't decrypt it: ask for a new link", name)
+	}
+	// Databricks secrets and SOPS values are changed in place.
+	return fmt.Errorf("%s has changed since the link was made, so it can't decrypt it: ask for a new link", name)
+}
+
 // CheckPath accepts a path relative to a repo's root, with slashes, of an
 // env file (.env, .env.local, prod.env) outside .git: what a link may
 // write.