Harden headless connect: reachability preflight gate, confirm inferred org, resync stale workspace

Surfaced from a live test of the published 1.11.0 plugin on ChatGPT (Work Mode). Three independent, actionable gaps. The auth chain itself worked end-to-end once pointed at a reachable org, so these are adherence / UX / freshness fixes, not an auth-credential bug.

Session evidence (self-contained)

• Fresh ChatGPT workspace. No .NET runtime -> Dataverse CLI installs but cannot execute (Failed to create CoreCLR, HRESULT: 0x8007000E); the agent correctly fell back to the Python SDK path.
• Device-code sign-in succeeded (login.microsoftonline.com reachable).
• First SDK data call against aurorabapenvf1eae.crm10.dynamics.com returned HTTP 502 from mitmproxy 12.2.3 with body [Errno 111] Connection refused. The same 502 occurred with no access token -> not auth.
• Re-run against a different org on the same host suffix (aurorabapenv981b2.crm10.dynamics.com) succeeded and returned a real query result in ~30s-1m.
• Conclusion: egress to *.dynamics.com is open; the first org's front door refused the connection -> that org is down / deprovisioned (preprod / TIP recycling), NOT an egress-policy block.
• The workspace .env still records plugin 1.8.0 and its copied scripts/auth.py predates the 1.11.0 helper.

1. Make the reachability preflight a hard gate before the user's query

python scripts/auth.py --check (a real data-plane call, already shipped -- see dv-connect/references/headless-hosts.md and the dv-overview "Connectivity is not auth" note) was NOT run before the query. Result: ~6 minutes plus a device-code sign-in were spent against a dead org before the failure surfaced.

Fix: on a constrained / headless host, run --check BEFORE the user's query and gate on it. On NOT REACHABLE, stop and report unreachable (with the documented remediation); never proceed to a full query or a sign-in against an unverified org.

Bonus (same area): the failure message told the user to "restart the session with the Dataverse plugin / MCP enabled." That is wrong on ChatGPT web -- MCP/CLI cannot run there (no .NET, per the CoreCLR error above) and a restart will not clear a network / unreachable-org error. Add an explicit rule: a post-auth 5xx / Connection refused / proxy 502 is an egress / unreachable-org condition, NOT a restart-able one; emit the headless-hosts remediation (allowlist *.dynamics.com in sandbox egress / use a server-side connector / run where egress is open / pick a reachable org).

2. Confirm an inferred or pre-existing target org before signing in

The agent selected the target org from prior conversation history plus a stale .env, and never confirmed it -- it turned out to be the wrong (and dead) environment, and the user had to correct it twice. Since a device-code prompt is expensive, when the target org is inferred (from history) or read from a pre-existing .env rather than stated by the user in the current request, confirm it before initiating sign-in -- especially when more than one environment is on record.

3. Resync stale workspace copies on plugin version mismatch (relates to #114)

The workspace was initialized under 1.8.0 and never re-synced after 1.11.0 was published: .env reports 1.8.0 and the copied scripts/auth.py predates the 1.11.0 helper. Impact: the v1.11 auth fixes do not actually run in that workspace, and telemetry attributes the wrong version.

Fix: dv-connect Step 0 should detect a plugin-version mismatch (installed package vs .env) and re-copy scripts/ + refresh .env, not merely refresh the DATAVERSE_PLUGIN_VERSION string.

Not a bug (for the next reader)

The 502 itself is correct external behavior -- a dead preprod org refused the connection. The plugin already documents "connectivity is not auth"; the gap is that the agent did not apply the preflight that exists to catch it.

Start with dv-connect Step 0 and scripts/auth.py, then read dv-connect/references/headless-hosts.md and the dv-overview “Connectivity is not auth” note. Run python scripts/auth.py --check while tracing the preflight, target confirmation, and version-mismatch paths. Done means unreachable orgs are gated, inferred targets are confirmed before sign-in, and stale scripts plus .env are resynced.