Adit fix, address copilot comments

__tests__/saveCache.test.ts

@@ -265,6 +265,7 @@ test('save with reserve cache denied by read-only token logs warning (not info)'
     `Failed to save: Unable to reserve cache with key ${primaryKey}. More details: ${deniedMessage}`
   )
 
+  expect(logWarningMock).toHaveBeenCalledTimes(1)
   expect(reserveCacheMock).toHaveBeenCalledTimes(1)
   expect(createTarMock).toHaveBeenCalledTimes(1)
   expect(saveCacheMock).toHaveBeenCalledTimes(0)

__tests__/saveCacheV2.test.ts

@@ -154,6 +154,7 @@ test('create cache entry denied by read-only token logs single warning and skips
     `Failed to save: Unable to reserve cache with key ${key}. More details: ${deniedMessage}`
   )
 
+  expect(warningLogMock).toHaveBeenCalledTimes(1)
   expect(createCacheEntryMock).toHaveBeenCalledWith({
     key,
     version: cacheVersion

src/cache.ts

@@ -45,8 +45,9 @@ export const CACHE_WRITE_DENIED_PREFIX = 'cache write denied:'
  * Raised when the cache backend refuses to reserve a writable cache entry
  * because the JWT issued for this run was scoped read-only (for example, the
  * run was triggered by an event the repository administrator classified as
- * untrusted). The error message is forwarded verbatim from the receiver and
+ * untrusted). The receiver-supplied detail message always begins with
- * always begins with `cache write denied:`.
+ * `cache write denied:` (the full error message includes additional context
+ * like the cache key).
  *
  * Extends ReserveCacheError for source-compatibility: existing
  * `instanceof ReserveCacheError` checks and `typedError.name ===