Follow-up from "Add send_duo_session_input MCP tool"

The following discussion from !255535 (merged) should be addressed:

• @GitLabDuo started a discussion:

  This treats every 403 returned by the resume route as "not waiting for input, or you cannot resume it," but find_workflow! in the route can also return 403 for unrelated reasons, most notably forbidden_if_identity_verification_required!, whose message tells the caller to complete identity verification. Rewriting that message with the resumability guidance hides the real cause and points the agent at the wrong remediation (polling get_duo_session, which would fail for the same reason). Consider distinguishing the resumability-specific 403 (e.g. by checking for the bare authorize! failure message) from other 403s, and passing the latter through unchanged.