Cloud can release the upload of a sourceless Service after an undeployed image edit#4105

Found while reviewing the fix for #4034 (PR #4104). The defect is on main.

uploads::kept decides which Services Cloud keeps uploads for from the latest Saved State plus Services with a provisional choice in flight. A reapply (and a CI-hold promotion) can admit an older Saved revision.

1. Service S has no source and runs upload U0.
2. A user saves an image for S but does not deploy it. Nothing is in flight.
3. kept no longer counts S as sourceless, so Cloud can release U0.
4. A Door switch reapplies S at the older revision, where S has no source. Admission picks U0, and the upload is gone.

Likely fix: have kept also protect each Service that a Deployment in Applied State, or an older Saved revision a reapply may ship, has without a source.

Scores: F2 (needs an undeployed image edit on a sourceless Service, then a switch) × S5 (a build fails or ships nothing; a new upload recovers) = 10.