[freeqaz]

Problem

After #3733 (finding 2538), the console still wrote its own "You do not have permission to ..." and "Access denied. You do not have permission for this operation." sentences for save and action refusals. These sentences do not follow the console's refusal form: say what the caller's access does not include, then which grant to ask an Installation administrator for. Some named no usable grant ("read access to them", "permission to use its selected Slack bot Secret"). Others said "denied because you are not authorized".

Change

13 console-written refusal forms now use the shared access-reasons.mts helpers (notIncluded, askForGrant, askAdministratorTo, new actionRefused). Each one shows where the action was taken:

• Saves (Configuration, Agent, the reread before a save, a refused Secret binding), the workspace file save and Configuration create: "Save was refused: your access does not include saving this Configuration. Ask an Installation administrator for ...". This matches the "Stop was refused:" form in Match rejected-credential recovery to what the operator can do #3734. These keep fixed text: the save names its resource in words, where the API's named denial would show a raw ID.
• Sandbox policy (logs, policy, suggestions, validate, change, apply): notIncluded("reading this Agent's policy", "SandboxPolicy read on it") and similar. The editing setting says only an Installation administrator who also administers the Agent can change it.
• Repository choices: for an Agent, this names Agent update. For a new Agent, it gives the Agent create reason (only an administrator creates Agents).
• Generic 403 (an older API's unnamed denial): "Your access does not include this action." For a non-administrator it adds "Ask an Installation administrator to check your access."
• Recheck of an open Agent page and Slack people/channel lookup: each request checks several grants that the console cannot tell apart. They now show the API's named denial ("Slack lookup was refused: this needs Secret operate on ..."). When the API names no grant, they fall back to a console sentence that names the grants.

Not changed here: the Stop and Delete refusals, and agentSaveDenial. #3734 rewords them. docs/reference/console.md describes the save form.

Verification

• 474/474 tests pass on the branch across the 11 touched or affected files (the touched browser files, console-agent-detail, console-status-block, console-agent-repositories and tests/conformance/http-errors).
• With these tests on main b9a9336186, 31 fail and 443 pass. Every form has at least one failing sample. New tests: a refused recheck of an open Agent page, the policy editing setting, Agent repository choices, and a named Slack lookup refusal.
• Mutants: 12 of 12 caught, one per changed site.
• tsc --build is clean, and eslint and prettier are clean on the touched files.
• 20/20 pins at 2 CPUs and the browser lanes: results are in the comments below.

Risks

• This PR changes copy only. Requests, gating and focus behaviour are the same as before.
• It touches access-reasons.mts, list.mts and console.mjs lines near Match rejected-credential recovery to what the operator can do #3734 but not the same hunks. Match rejected-credential recovery to what the operator can do #3734's stopRefused and deleteRefused could reuse actionRefused after both land.
• No screenshots: this PR changes the text of existing alerts and status lines, not their layout.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.