feat: a refusing Databricks profile that signs in through az says to check the az account

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/databricks/databricks_test.go

@@ -322,10 +322,15 @@ func TestDeniedSaysWhatToCheck(t *testing.T) {
 	p := newTestProvider(t, workspaceAPI(t, 0), nil)
 	_, err := p.Objects(context.Background(), provider.Container{Source: provider.Source{ID: "prod"}, Name: "locked"}, provider.TypeSecret)
 	var d *provider.Denied
-	if !errors.As(err, &d) || !strings.Contains(err.Error(), "READ permission on scope locked\n\nCheck:\n• you have access to the workspace") {
+	// The test profile signs in through az: that's the first check.
+	if !errors.As(err, &d) || !strings.Contains(err.Error(), "READ permission on scope locked\n\nCheck:\n• az is signed in as the account with access: profile prod uses your az login") ||
+		!strings.Contains(err.Error(), "\n• you have access to the workspace") {
 		t.Errorf("err %q", err)
 	}
-	if got := deniedChecks("Source IP address: 1.2.3.4 is blocked by Databricks IP ACL for workspace: 1"); !strings.Contains(got[0], "network") {
+	if got := deniedChecks(profile{authType: "pat"}, "denied"); strings.Contains(got[0], "az") {
+		t.Errorf("a token profile's checks %q", got)
+	}
+	if got := deniedChecks(profile{}, "Source IP address: 1.2.3.4 is blocked by Databricks IP ACL for workspace: 1"); !strings.Contains(got[0], "network") {
 		t.Errorf("IP ACL checks %q", got)
 	}