Edge Delivery SharePoint content source fails in the collect phase: the sharing link no longer exists

The code side of my Edge Delivery site is working. Code Sync serves my blocks, styles
and 404 page from the repository. No document has ever previewed, because the content
bus cannot read the folder.

Setup

1. Site set up through the tools.aem.live configuration wizard.
2. Content source is a SharePoint team site document library, the journal folder of the
   site's Documents library.
3. The folder is shared with helix@adobe.com at Can edit. Manage Access lists it as an
   external user, and there is a matching entry under Links.
4. The content source URL is set in Site Admin, Edit Sources, and verified by reopening
   the form after saving.

What happens

Loading the preview host returns my own 404 page with this banner:

  (404) Unable to fetch /index.md from onedrive
  (404) The sharing link no longer exists, or you do not have permission to access it.

Running the same preview from Admin Tools, Bulk Operations, over seven paths returns
0/7 in about half a second. The job detail is the useful part:

  "data": { "paths": [ seven paths, all correct ], "phase": "collect" },
  "error": "The sharing link no longer exists, or you do not have permission to access it."

Every path parses correctly. The failure is in the collect phase, at the folder lookup,
before any document is touched.

What I have already ruled out

1. Drive type. A personal OneDrive folder and a SharePoint team site library fail
   identically.
2. Configuration location. fstab.yaml in the repository is not what governs a site set
   up through the wizard. The configuration service holds the correct URL, confirmed by
   two successful config writes in the audit log and by reopening the form.
3. The Sidekick. Removing it from the path entirely by running the preview server side
   through Bulk Operations produces the same result.
4. The URL form. Using a real SharePoint sharing link scoped to helix@adobe.com as the
   content source, taken from Manage Access, gives the same error.

Questions

1. Is this the signature of a guest access restriction at the Microsoft 365 tenant
   level, rather than anything wrong with the project configuration?
2. If so, is admin consent to the AEM Content Integration application the supported fix,
   and what exactly does a tenant administrator need to approve? I would like to give
   ours a precise request rather than a general one.
3. Is there anything else that produces a collect phase failure with this error that I
   have not thought to check?