Rollout decision for #133716: an older Desktop or a third-party client
that does not send confirm_deep_truncate would otherwise get 4033 on
every deep edit or restore as soon as only the backend upgrades. The
reporter's Windows Desktop plus WSL serve setup is exactly that pair.
This release logs the unconfirmed deep cut and still runs it. The
upgraded Desktop asks before a deep cut on its own.
DEEP_TRUNCATE_ENFORCED flips it to the 4033 refusal next release. The
refusal tests run with it on, a new test pins the warn-only behaviour,
and the integration doc and contract comment say so.
10cf193745