A redeploy across a build-settings change fails late, with no reason given, under device approval#4064

Found while verifying #4058 (D6).

Under device approval, ployz deployment redeploy N rebuilds a Git Service when N has no usable image token. If N's saved revision builds that Service with other build settings than the automatic deploy rule approves, the builder refuses ("the deployment Cloud sent does not build with the rule's policy"). That refusal is correct, but the CLI learns of it late and badly:

1. The CLI signs a BuildApproval and admits the redeploy. Cloud dispatches the workflow, and only once the GitHub run ends does the CLI print GitHub didn't build web: the run ended before it started the build. That took about 3 minutes in the lab, and the message doesn't say why.
2. The runner's report of its own refusal is refused by Cloud (HTTP 409), so Cloud can't say why either.

Fix sketch: in handlers/deploy/built.rs prepare, compare the source revision's build input for each Service against the rule's policy (as handlers/build/rule.rs policy does) and refuse before signing, with something like "#N built web with other build settings than the rule approves." Separately, let Cloud take the report of a refusal that happens before check-in.

F 2 (a rollback across a build-settings change, under enforcement), S 5 (a broken flow; you can roll back to a deployment at the current settings instead). F×S = 10, so it's filed rather than fixed in #4058.