[CBTF Messaging] Not arriving through PrairieTest

If a student does not arrive through PrairieTest (but is in the CBTF), they get shown a generic permission denial. It would be more helpful to direct them to PrairieTest.

Trace the CBTF permission-denial path for students who are present in the CBTF but did not arrive through PrairieTest. Start by finding where the generic denial is produced and identify the relevant messaging or authorization tests. Done means those students receive guidance to use PrairieTest instead of the generic permission-denial message.

Written by the indexing model from the issue text.