feat: a key that no longer decrypts a share link says why

By where it lives: a Databricks secret or SOPS value has changed
since the link was made, an Azure secret's current version isn't the
link's (unpinned), and a pinned version can't have changed, so the
link may be damaged. The popup wraps the reason instead of cutting
it; r is for what Key Vault adds to check.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/share/share_test.go

@@ -49,11 +49,33 @@ func TestSealOpen(t *testing.T) {
 	if len(got) != 2 || got[1].Path != files[1].Path || string(got[1].Data) != string(files[1].Data) {
 		t.Errorf("opened %+v", got)
 	}
-	if _, err := s.Open([]byte("another key, long enough to use")); err == nil || !strings.Contains(err.Error(), "doesn't decrypt") {
+	if _, err := s.Open([]byte("another key, long enough to use")); err == nil || !strings.Contains(err.Error(), "env-share at version 91d3e0 doesn't decrypt it") {
 		t.Errorf("wrong key: %v", err)
 	}
 }
 
+func TestWrongKeySaysWhy(t *testing.T) {
+	files := []File{{Path: ".env", Data: []byte("A=1\n")}}
+	for link, want := range map[string]string{
+		"lazysecrets://databricks/adb-1.1.azuredatabricks.net/team/env-share": "env-share has changed since the link was made",
+		"lazysecrets://repo/git.example.com%2Fteam%2Fapp/secrets.yaml/share":  "share has changed since the link was made",
+		"lazysecrets://azure/kv-team.vault.azure.net/secrets/env-share":       "env-share's current version isn't the one the link was made with",
+	} {
+		k, err := ParseKey(link)
+		if err != nil {
+			t.Fatal(err)
+		}
+		r, err := Seal(Header{Key: k}, pass, files, Rules{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		s, _ := Read(r)
+		if _, err := s.Open([]byte("rotated since, and long enough to be a key")); err == nil || !strings.Contains(err.Error(), want) {
+			t.Errorf("%s: %v, want %q", link, err, want)
+		}
+	}
+}
+
 func TestSealRefuses(t *testing.T) {
 	ok := []File{{Path: ".env", Data: []byte("A=1")}}
 	for name, c := range map[string]struct {