Require deploy permission when setting a post-install script or extra SSH keys, document the 403 response, and cover both denial and allowed deployment cases.