fix(drive,docs): build request before the lease gate

[newhoggy]

Summary

• drive sheets format-cells/update-borders/etc. and the structure verbs no longer orphan a pending audit record when building the request fails after the lease gate — both engines now build the request before the gate, matching protection.rs's existing shape.
• Fixes fix(drive): sheets format/structure orphan the pending audit record when build_request fails after the lease gate #1688.

Test plan

• cargo build
• cargo test --lib drive::sheets:: (485 passed)
• cargo clippy --all-targets -- -D warnings
• Reviewed via /code-review high — no correctness bugs found; two minor cleanup findings noted but left as-is (comment duplication, and a documented-only ordering contract) since neither is a bug

[github-actions]

Coverage

Total: 97.27% ⚪ 0 pp vs main

Comparing e78ba2f..81037b6 (merge-base → PR head)

No per-file coverage changes vs main.

🔇 5 ignored region(s), 0 tolerated region(s)

ignore removes the lines from both reports; tolerate keeps them in the reported percentage but scores them against the baseline, so a cross-run flip cannot move a delta. Regions are read from each revision's own source.

File	Kind	Lines	Rev	Reason
src/cli/drive/lease.rs	ignore	408-412	both	a sheet restore's fresh backup is always a DriveCopy — restore.rs's own recheck refuses unless the target is still a spreadsheet, and acquire() only ever takes a Bytes backup of a non-native target; this arm exists solely for exhaustiveness over the shared LeaseBackup enum
src/cli/drive/lease.rs	ignore	882-885	both	guards this test helper against misuse; every call site below passes an acquire subcommand
src/cli/drive/lease.rs	ignore	896-899	both	guards this test helper against misuse; every call site below passes a prune subcommand
src/drive/lease/ledger.rs	ignore	743-747	both	mutate_locked refuses before ever calling the closure, so its body never runs — a hit here is a regression, not a coverage gap
src/drive/lease/restore.rs	ignore	977-981	both	every test using this double refuses before authenticating; a hit here is a regression, not a coverage gap

Patch coverage

Patch: 100% (50/50 new lines covered)

File	Patch	Uncovered new lines
src/drive/sheets/format.rs	100% (10/10)	—
src/drive/sheets/structure.rs	100% (40/40)	—

_{📦 Full per-file coverage summary · run summary}