fix(ci): narrow a row's architecture by its service closure too

A row drew its architecture from the run's pool narrowed by the role's
own meta/services.yml declaration only. The deploy also brings up every
role in the transitive service closure, so a single-architecture
provider still received rows on hardware it cannot run on.
row_architectures now intersects the pool with the declarations of the
role and of each closure role, which assign() passes from the
complexity row.

No role declares architectures today, so no current row changes. The pin
validator in cli/meta/ci/validate.py still checks the role alone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/python/utils/github/variant/test_axes.py

@@ -665,6 +665,22 @@ class TestArchitectureAxis(unittest.TestCase):
             )
         self.assertEqual({entry["architecture"] for entry in entries}, {"arm64"})
 
+    def test_a_service_in_the_closure_narrows_the_row_like_the_role(self) -> None:
+        rows = [
+            {**_row("web-app-b", index, ("compose",)), "services": ["svc-db-x"]}
+            for index in range(4)
+        ]
+        declared = {"svc-db-x": ["amd64"]}
+        with mock.patch.object(
+            axes,
+            "get_role_architectures",
+            side_effect=lambda role: declared.get(role, []),
+        ):
+            entries = _assign(
+                rows, sweep=0, tor_mode="disabled", variants_per_app=_VARIANTS
+            )
+        self.assertEqual({entry["architecture"] for entry in entries}, {"amd64"})
+
     def test_a_role_and_run_that_permit_nothing_in_common_abort(self) -> None:
         rows = [_row("web-app-b", 0, ("compose",))]
         with (