Legacy enforcement-refusal text fallback never matches an initial refusal #4057

Found while reviewing #4056 (untangle chunk A). In core/crates/ployz/src/sdk/prepare.rs:183 with build/remote.rs:192, the fallback that matches the enforcement refusal by message text (for daemons that send no details.capability) cannot match an initial refusal: admission prefixes the message before the equality check. Main already behaves this way, so #4056 neither adds nor fixes it; its new test covers only the typed-capability path.

Impact: a build against an old daemon that refuses without a capability gets the generic refusal text, not the enforcement one.

Scores: F=2 (only old daemons that predate the capability), S=3 (wrong label on a refusal, no data or security effect). F×S=6, so filed, not fixed.