fix: classify 403 forbidden as workspace-mismatch

[wwenrr]

Summary

• treat common HTTP 403/Forbidden responses as workspace-mismatch in failover classification
• keep auto-switch policy unchanged (still only switches for supported reasons)
• add tests to cover 403 plain-text and JSON payload cases

Why

Some workspace/organization policy failures return 403-style messages instead of the current keyword set. Without this mapping, those failures are not classified and no failover is attempted.

Verification

Ran locally:

• npm test → 23 passed
• npm run build → pass
• npm run release:check → Release guard passed

Scope check

Changed files only:

• src/core/failover-engine.ts
• tests/failover-engine.test.ts

[NgoQuocViet2001]

Thanks for the focused fix. Classifying the common 403/Forbidden workspace-policy path as workspace-mismatch makes sense for this project and the extra tests are helpful too.