fix: surface spend-precheck denial as RATE_LIMITED - #3749

This commit only merges another branch into the PR branch, so cubic completed this check without running an AI review. cubic will review your next non-merge commit.