Surface stale Sentry slug in ListAccounts error

ListAccounts on a connector whose stored slug is no longer accessible
to its OAuth token currently returns "cannot fetch sentry members:
unexpected status 404" -- opaque, and indistinguishable from a real
Sentry outage. The campaign source-fetch worker records that string
verbatim as the customer-visible LastError, with no hint that the
connector itself needs reconnection.

queryMembers now returns a sentinel errSentryOrgNotAccessible on 404,
and ListAccounts wraps it with the slug and a directive to reconnect.
errors.Is preserves the chain so future callers can branch on the
permanent-config-failure case without string matching.

No auto-recovery: the only safe slug is one the customer explicitly
chose. Picking a different visible org would silently rebind the
source to the wrong tenant.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/sentry_test.go

@@ -48,6 +48,27 @@ func TestSentryDriver(t *testing.T) {
 	assert.NotEmpty(t, r.Role)
 }
 
+func TestSentryDriverListAccountsStaleSlug(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, http.MethodGet, r.Method)
+		assert.Equal(t, "/api/0/organizations/acme-old/members", r.URL.Path)
+		w.WriteHeader(http.StatusNotFound)
+		_, _ = w.Write([]byte(`{"detail":"The requested resource does not exist"}`))
+	}))
+	defer srv.Close()
+
+	client := &http.Client{Transport: &hostRewriter{target: srv.URL}}
+
+	_, err := NewSentryDriver(client, "acme-old").ListAccounts(context.Background())
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `"acme-old"`)
+	assert.Contains(t, err.Error(), "not accessible")
+	assert.Contains(t, err.Error(), "reconnect")
+	assert.ErrorIs(t, err, errSentryOrgNotAccessible)
+}
+
 func TestSentryDriverListAccountsAutoDiscoversSlug(t *testing.T) {
 	t.Parallel()