Returns whether the deployment is locked (any of the three deployment policy
types is immutable) and, when locked, which template each policy type uses.

Used by the Admin Console to conditionally render the policy configuration UI:
LOCKED deployments hide tenant-side edit affordances and surface a read-only
badge naming the compliance preset; UNLOCKED deployments render the full
editor surface.

The lock state is platform-global (NOT per-tenant) and is read from a single
source of truth (the three deployment policy tables). Results are cached for
up to 60 seconds; cache misses execute one read per deployment policy table.

Required scope: admin.policy.deployment.all.read.