fix(ci): refuse a mesh pin the row cannot take

A selection token may pin the mesh state as &vpn or &direct, but check_pins
had no arm for it. pinned_vpn_states intersects the pin with the states the
mode allows and only swarm meshes, so a token like @compose+clearnet&vpn left
an empty state list: the row produced no job at all and the run reported green
for a combination that never deployed. That is the outcome _reject exists to
prevent, and every sibling axis already refuses an impossible pin.

The new arm asks whether any candidate mode keeps a state rather than whether
the pin is reachable, so a held vpn axis still overrides the pin instead of
being refused. That behaviour has its own test and is unchanged.

An earlier check was removed with the compose-mesh revert of 2026-10-16
because it rested on meshable() and smallest_variant(), which that revert
deleted. This one reuses pinned_vpn_states, applies to the swarm-only axis the
revert restored, and covers both mesh states instead of only &vpn.

pin_vpn and vpn_mode now reach check_pins from all three callers. The run's
vpn axis reaches the validation job through call-orchestrator and
call-validation, which passed every other axis but this one. The priority
procedure and its skill state all eight axes a token carries, not six:
architecture and mesh were pinnable and, for architecture, already validated,
yet neither was documented.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/python/utils/github/variant/test_axes.py

@@ -436,6 +436,21 @@ class TestPinnedAxes(unittest.TestCase):
         with self.assertRaises(SystemExit):
             _assign([row], sweep=0, tor_mode="disabled", variants_per_app=_VARIANTS)
 
+    def test_a_mesh_pin_on_a_mode_that_cannot_mesh_aborts(self) -> None:
+        """Only swarm meshes, so ``@compose…&vpn`` asks for a combination that
+        cannot exist. Intersecting it away instead left no state, dropped the
+        row, and reported a green run for a row that never deployed."""
+        row = _row("web-app-b", 0, ("compose",), pin_vpn=True, priority=True)
+        with self.assertRaises(SystemExit):
+            self._entries(row)
+
+    def test_an_unpinned_mode_is_refused_only_when_no_mode_can_mesh(self) -> None:
+        meshable = _row("web-app-b", 0, ("compose", "swarm"), pin_vpn=True)
+        self.assertNotEqual(self._entries(meshable), [])
+        hostbound = _row("web-app-b", 0, ("compose", "host"), pin_vpn=True)
+        with self.assertRaises(SystemExit):
+            self._entries(hostbound)
+
 
 class TestResolvePool(unittest.TestCase):
     def test_an_empty_input_opens_the_whole_declared_set(self) -> None: