Surface stale Sentry slug in ListAccounts error

ListAccounts on a connector whose stored slug is no longer accessible
to its OAuth token currently returns "cannot fetch sentry members:
unexpected status 404" -- opaque, and indistinguishable from a real
Sentry outage. The campaign source-fetch worker records that string
verbatim as the customer-visible LastError, with no hint that the
connector itself needs reconnection.

queryMembers now returns a sentinel errSentryOrgNotAccessible on 404,
and ListAccounts wraps it with the slug and a directive to reconnect.
errors.Is preserves the chain so future callers can branch on the
permanent-config-failure case without string matching.

No auto-recovery: the only safe slug is one the customer explicitly
chose. Picking a different visible org would silently rebind the
source to the wrong tenant.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/sentry.go

@@ -17,6 +17,7 @@ package drivers
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -26,6 +27,10 @@ import (
 	"go.probo.inc/probo/pkg/rfc5988"
 )
 
+// errSentryOrgNotAccessible signals a 404 scoped under an organization
+// slug; Sentry uses 404 (not 403) so this also covers revoked memberships.
+var errSentryOrgNotAccessible = errors.New("sentry organization is not accessible by this connector's token")
+
 // SentryDriver fetches organization members from Sentry via Bearer
 // token-authenticated REST API requests.
 type SentryDriver struct {
@@ -97,6 +102,10 @@ func (d *SentryDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error
 	for range maxPaginationPages {
 		members, linkHeader, err := d.queryMembers(ctx, nextURL)
 		if err != nil {
+			if errors.Is(err, errSentryOrgNotAccessible) {
+				return nil, fmt.Errorf("sentry organization %q is not accessible; reconnect the connector with the correct organization: %w", orgSlug, err)
+			}
+
 			return nil, err
 		}
 
@@ -178,6 +187,10 @@ func (d *SentryDriver) queryMembers(ctx context.Context, url string) ([]sentryMe
 		_ = httpResp.Body.Close()
 	}()
 
+	if httpResp.StatusCode == http.StatusNotFound {
+		return nil, "", errSentryOrgNotAccessible
+	}
+
 	if httpResp.StatusCode < 200 || httpResp.StatusCode >= 300 {
 		return nil, "", fmt.Errorf("cannot fetch sentry members: unexpected status %d", httpResp.StatusCode)
 	}