CXH-2350: surface workspace-token sync limits and fix PAT setup docs

[al-conductorone]

Workspace-token (PAT) syncs now log a startup warning that account-level access is not covered, so a switch to PAT no longer silently drops data from access reviews. Also fixes the PAT setup example, which previously could not start, and corrects the workspace/token pairing instructions.

[linear-code]

CXH-2350

[github-actions]

Connector PR Review: CXH-2350: surface workspace-token sync limits and fix PAT setup docs

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base ef6c2aae70ca.
Review mode: full
View review run

Review Summary

Scanned the full PR diff for security and correctness: it touches README.md, docs/connector.mdx, and adds one startup Warn in Databricks.Validate when the account plane is unreachable but the workspace plane is not. Every behavior the new docs describe was verified against the code — positional pairing of --workspaces/--workspace-tokens (pkg/databricks/auth.go:39), the equal-length startup rejection (pkg/config/config.go:126), the workspaces/databricks-exclude-workspaces mutual exclusion (pkg/config/config.go:93), and the claimed sync gaps under workspace-token auth (pkg/connector/account.go:94, pkg/connector/workspaces.go:193, pkg/connector/helpers.go:44) all match. Warn is the correct level for this expected customer-config condition, no dependency manifests changed, and no new issues were found.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

[github-actions]

No blocking issues found.