Admission exclusions for polled integrations must be evaluated before enrichment

Admission exclusions for polled integrations must be evaluated before enrichment, deduplication, persistence, and outbound side effects. Adding a deny rule only to downstream routing is insufficient when the poller first refreshes an existing assignment or short-circuits on a dedupe match. This applies when the exclusion facts are available in the provider payload; it does not define whether already-created workflows should be cancelled, hidden, or left intact—that lifecycle policy still needs an explicit product decision.