Return the managed-policy block notice a reload reported, if any.
Scans the whole list rather than only its first entry. The notice is prepended today, so position would work -- but a caller that reads a blocked reload as success mounts "Restart complete." on the previous policy generation, and one future entry prepended ahead of the notice would cause that at all four call sites at once. Scanning cannot regress that way, and only this module produces the prefix.
