#7238 fix(dataverse): harden OAuth connection preflight

Summary

• preserve canonical legacy scopes in generic Dataverse OAuth authorization
• fail Dataverse reconnects before draft creation when the environment binding cannot be trusted
• surface invalid workflow environments and Better Auth link failures instead of reporting success

Type of Change

• Bug fix

Testing

• 28 targeted tests passing
• bun run lint:check
• bun run type-check
• bun run apps/sim/scripts/check-block-registry.ts origin/staging
• bun run check:audits

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)