move pin handling out of `evaluateRules`

[jcristau]

As pointed out in #3065 (comment), pinnable releases only matter for AppReleases, so it'd be cleaner for the generic/shared code to not have to worry about them.