A preview push by an account the rule doesn't trust fails with an unrelated build message#4065

Found in #4055's lane 3, on servers that enforce device approval with a preview rule.

A push by an organization member whose GitHub account the preview rule doesn't trust opens a PR Environment, and its Deployment fails at the build. Each server refuses the grant correctly ("the approval names an account this request does not match" in its log), but the user never sees that reason:

• The builder run logs Ployz Cloud refused the build (HTTP 503): Your Cluster could not mint a Build Grant.
• Cloud then falls back to a Servers build, and ployz deployment show reads No eligible Build Machine was selected ... This server runs only builds an approved device starts. and GitHub skipped it: the run ended before it started the build.

The server already has a plain refusal for this ("The preview rule doesn't trust the account that pushed. Approve it again with --trust and their GitHub ID."). It should reach the Deployment's build line, and Cloud shouldn't fall back to a Servers build that enforcement will refuse anyway.

This is part of a known D7 gap: Cloud's members list still decides when to build, while servers enforce the rule's trusted list.

• F 3: only members left out of --trust, under enforcement.
• S 3: nothing deploys, which is correct. The flow is confusing, and the workaround (approve again with --trust) isn't shown.
• F×S 9, under the bar, so filed rather than fixed in #4055.