feat: a refusing Databricks profile that signs in through az says to check the az account

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/databricks/databricks.go

@@ -318,18 +318,23 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 }
 
 // deniedChecks are what to check when Databricks refuses: the network,
-// when the workspace's IP access list refused, else access.
-func deniedChecks(msg string) []string {
+// when the workspace's IP access list refused, else access, and for a
+// profile signed in through az, which account az is on.
+func deniedChecks(pr profile, msg string) []string {
 	if strings.Contains(msg, "IP ACL") || strings.Contains(msg, "IP access list") {
 		return []string{
 			"you're on a network the workspace lets in (VPN, office)",
 			"the workspace's admin has let your network in",
 		}
 	}
-	return []string{
+	var checks []string
+	if pr.authType == "azure-cli" {
+		checks = append(checks, "az is signed in as the account with access: profile "+pr.name+" uses your az login (az account show)")
+	}
+	return append(checks,
 		"you have access to the workspace",
 		"the scope's manager has given you READ on it, or a group you're in",
-	}
+	)
 }
 
 var errNoFallback = errors.New("no Key Vault fallback")
@@ -369,7 +374,7 @@ func classify(pr profile, err error) error {
 	var api *apierr.APIError
 	if errors.As(err, &api) {
 		if api.StatusCode == 403 {
-			return &provider.Denied{Err: err, Checks: deniedChecks(api.Message)}
+			return &provider.Denied{Err: err, Checks: deniedChecks(pr, api.Message)}
 		}
 		if api.StatusCode != 401 {
 			return err