fix(server): block updates under legacy service launchers - #11940

Eligibility
This is a small, targeted compatibility fix that blocks unsafe updates from legacy launchers while preserving the current protocol path. Its runtime impact is confined to the existing service preflight boundary and is directly covered by tests.

Notes:
No code owners found in target merge base 3efdcc5