Dashboard Deploy can ask for a passkey before refusing a tag image or stale plan#4045

Found in the B5 review (#4043). With no live approval session, the canvas Deploy calls approval.scope() (passkey prompt) before it reads and checks the plan, so a tag image, a build, or a plan of another version prompts for a passkey and then refuses. Nothing is signed or admitted; it is a wasted prompt. Fix: read and validate the plan before approval.scope(), and test refusal before any credential call without a session (approval-session.test.ts:411 currently establishes a session first).

Scores: F 4 (tag images are common), S 3 (an extra prompt, no wrong outcome).