fix(runner): log auth fallback and show workspace URL in fatal 403 error

Two small diagnostics improvements surfaced by the gtm-ai-agent 403 loop
investigation (OMNI-2529 thread, Slack 2026-08-14).

**Log when proxy_auth_failed triggers SDK/OIDC re-resolve:**
`_InitialAuthTokenFactory.__call__` silently swapped out the factory
when the managed-mint proxy bearer expired.  An info-level log now names
the server URL so operators can trace exactly when and for which endpoint
the fallback fired — visible in `~/.omnigent/logs/server/` alongside the
surrounding 403 timeline.

**Show workspace URL (not Apps URL) in the fatal tunnel 403 error:**
When the WS tunnel upgrade 403s three times and the runner exits, the
error said `run 'databricks auth login --host <apps-url>'`.  The Apps URL
is the Omnigent server endpoint, not the Databricks workspace — running
`databricks auth login` against it does nothing useful.  The fix resolves
the stored `omnigent login` pointer record to the workspace host (e.g.
`https://adb-1234.azuredatabricks.net`) and surfaces that instead when
available, so the actionable command in the error matches what the team
was already asking users to run manually during incidents.

Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>

omnigent/runner/_entry.py

@@ -422,6 +422,10 @@ class _InitialAuthTokenFactory:
             # once a session outlives it. Re-resolve SDK/OIDC in the same call
             # so the request that hit the failure still gets a credential.
             if token is None and getattr(self._fallback_factory, "proxy_auth_failed", False):
+                _logger.info(
+                    "managed-mint proxy bearer expired; re-resolving SDK/OIDC credential for %s",
+                    self._server_url,
+                )
                 self._fallback_factory = _make_auth_token_factory(
                     self._server_url,
                     _allow_initial_token=False,

omnigent/runner/transports/ws_tunnel/serve.py

@@ -427,11 +427,21 @@ async def serve_tunnel(
                 if http_status is not None and http_status in _REFRESHABLE_HTTP_STATUSES:
                     http_auth_rejection_streak += 1
                     if http_auth_rejection_streak >= _HTTP_AUTH_REJECTION_FATAL_ATTEMPTS:
-                        login_hint = (
-                            f"run `databricks auth login --host {server_url}` to re-authenticate"
-                            if server_url
-                            else "check remote server authentication"
-                        )
+                        if server_url:
+                            from omnigent.cli_auth import load_databricks_workspace_host
+
+                            workspace_host = load_databricks_workspace_host(server_url)
+                            login_hint = (
+                                f"run `databricks auth login --host {workspace_host}` "
+                                "to re-authenticate"
+                                if workspace_host
+                                else (
+                                    f"run `databricks auth login --host {server_url}` "
+                                    "or `omnigent login` to re-authenticate"
+                                )
+                            )
+                        else:
+                            login_hint = "check remote server authentication"
                         raise RuntimeError(
                             f"{RUNNER_TUNNEL_REJECTION_PREFIX}"
                             f"(HTTP {http_status} persisted across "