Deferred artifact builds must invalidate upstream completion when they fail

A deployment dependency is not actually complete if a downstream-required artifact build was deferred and later fails. When that happens, reopen the producing work, correct and re-approve the artifact definition, and prevent the deployment task from inventing a workaround. This applies when the failed build is part of the dependency's acceptance contract; it does not apply to failures caused solely by unrelated downstream infrastructure.

For a first deployment with no prior approved image digest, define rollback as the known-safe zero-traffic state: keep routing disabled, revoke or detach newly created access paths if validation fails, stop the candidate service, and leave the primary application on its existing path. After the first digest passes acceptance and is adopted, it becomes the baseline for later image rollback.