Broker fixes for token refreshes and AccessDeniedException (#3161)

src/Sdk/WebApi/WebApi/BrokerHttpClient.cs

@@ -110,9 +110,14 @@ namespace GitHub.Actions.RunService.WebApi
                 return result.Value;
             }
 
+            // the only time we throw a `Forbidden` exception from Listener /messages is when the runner is
+            // disable_update and is too old to poll
             if (result.StatusCode == HttpStatusCode.Forbidden)
             {
-                throw new AccessDeniedException(result.Error);
+                throw new AccessDeniedException($"{result.Error} Runner version v{runnerVersion} is deprecated and cannot receive messages.")
+                {
+                    ErrorCode = 1
+                };
             }
 
             throw new Exception($"Failed to get job message: {result.Error}");