push-hook: hold subscription open after validating access

When we receive a watch-nack on a versioned subscription, we attempt to
resubscribe on an unversioned path. However, if we receive an unversioned
subscription request for which we are not compatible, we hold the
subscription open and never send any facts on unversioned subscriptions.
As the check for unversioned compatiblility occurs before retrieving the
initial-watch, subscriptions which are supposed to nack never do. Fixed
by moving the conditional.

Fixes urbit/landscape#795

pkg/arvo/lib/push-hook.hoon

@@ -297,14 +297,14 @@
       ::
       ++  unversioned
         ?>  ?=([%ship @ @ *] t.path)
-        ?.  =(min-version.config 0)
-           ~&  >>>  "unversioned req from: {<src.bowl>}, nooping"
-           `this
         =/  =resource
           (de-path:resource t.path)
         =/   =vase 
           (initial-watch:og t.t.t.t.path resource)
         :_  this
+        ?.  =(min-version.config 0)
+           ~&  >>>  "unversioned req from: {<src.bowl>}, nooping"
+           ~
         [%give %fact ~ (convert-to:ver update-mark.config vase)]~
       --
     ::