build: Add an option to block non-enforcing builds

Prevent accidental build of test configurations. Hopping back and
forth between states (especially disabled) leaves a mess in the
filesystems, and we want to try to ensure published builds go out
enforcing.

Change-Id: I2206975968de421dec842f49b02490fa85ca9f3b