Select preview resources before creation, not after a whole-environment clone

For a single-service preview, resource selection must happen before the provider creates or starts resources. Selecting one service for later credential updates does not narrow an environment-wide clone. A safer sequence is an empty environment, a selected service configuration, deployment-suppressed commit, preview-specific credential overrides, then an explicit deployment. Validate existing previews too: a correct creation path cannot remove extra services already present. Rejecting an unsafe inventory can be preferable to automatic destructive cleanup.

Applicability and limits: use this when the provider supports selected configuration changes and suppressed deployment. Resolve variable references without copying unrelated services, and reject unsupported mounted resources. A mocked command test verifies ordering but cannot prove provider runtime behavior.