Deploy refusal says 'pinned by digest' when the image is pinned but not the approved one#4019

Found by the C2 swarm (#4018). deploy_approval.rs maps every image mismatch to "This server runs only images pinned by digest." Since C2, the same refusal also covers a pinned image that isn't the one the Device approved (another digest, a platform digest, or another spelling), so the message misleads. Suggest a separate message, e.g. "This service's image isn't the one the device approved." The journal line is already correct. Scores: F 2, S 2.