Function filter_expired_pins 

pub fn filter_expired_pins(resolved: &mut FleetResolved, now: DateTime<Utc>)

Drop expired pins (past expires_at); affected hosts fall back to the current-commit build path. Pins with no expires_at always remain.