404 copy tells a permission-denied user we are investigating an error - turns every authz denial on /alumnos/[id] and /comisiones/[id] into a support ticket

An authed-but-unauthorized viewer on /alumnos/[id] and /comisiones/[id] is served the generic app 404, which is deliberate (no-existence-leak notFound(), commented as such at alumnos/[id]/page.tsx:58 and comisiones/[id]/page.tsx:148). The denial is NOT silent server-side - it logs alumno-detail-access-denied / comision-detail-access-denied at level info, status denied, with actorUserId and a named reason. Because those rows are info they correctly never reach the scrp-applog-mars alarm (MARS-171 tiering, verified working 2026-09-19). Net effect: the FIRST signal anyone gets is a support ticket saying 'página no encontrada', and the user has been told something false. Measured live on v2.79.80 (dpl_A493xBkTDNwAWEwyABZZ76fMsrbr) during the MARS-744 lector walk, session proven lector (users 900eb3d8, viewAllPracticas only): /alumnos/a4dd51b9-ef72-4e58-a2e1-dcd3e06a3df6 and /comisiones/3d1154e2-651d-4262-a7bb-35168646134b both rendered 'Página no encontrada', with matching appEvents rows at 08:09:46.962Z and 08:07:36.398Z. The actual defect is the COPY, not the 404. not-found-client.tsx:NotFoundMessage renders 'Registramos el error y lo estamos revisando activamente.' on every 404. On a permission denial that sentence is untrue - nothing is being reviewed, the app is working exactly as designed - and it is precisely what prompts the user to file a ticket. It also cost a walk agent a wrong reading: it reported the page as rendering normally because the tab title said 'M | Alumno' (the static metadata literal at alumnos/[id]/page.tsx:29 renders on the not-found page too, a smaller sibling of MARS-750). Proposed fix, and the constraint that shapes it: do NOT branch the 404 copy on whether the cause was a denial - that reintroduces the existence leak the notFound() exists to prevent. Instead change the copy UNIFORMLY for all 404s: drop or soften the 'lo estamos revisando' claim, and add a standing line such as 'Si creés que deberías tener acceso a esta página, pedí acceso desde Ayuda' with a link to the access-request flow. Identical for a real miss and a denial, so nothing leaks, while the denied user is routed to the action that actually helps them instead of into the support queue. NotFoundMessage already varies by pathname (isPracticaRoute), so the shape exists. Secondary, same file: consider whether /alumnos/[id] should keep exporting a static metadata title at all, given it renders over the not-found body. Support side needs no code: the appEvents lookup is documented in support-evolutiva knowledge/mars.md - query action like '%-detail-access-denied%' for the reporter's actorUserId before treating such a ticket as a broken link. Related: MARS-750 (comisiones/[id] generateMetadata ungated, leaks the comision name in the title to the same denied viewer).