This is where declarative precision matters. Use D. Validate the inbound change set. The selected option is not chosen because it sounds familiar; it is chosen because it gives Salesforce the right instruction at runtime.
Change sets move supported metadata between connected Salesforce environments. The receiving org uses inbound change sets and deployment validation to confirm whether the package can be deployed safely.
The scenario describes a business outcome, not merely an administrative preference. If the feature is configured correctly, users get the intended result without depending on memory, spreadsheets, or manual policing. That is the professional standard for Platform App Builder work: place the rule in metadata, test it under the correct permissions, and keep the design supportable.
The other choices would leave a gap in the implementation. A (Remove Apex classes from inbound change set.) misses the mark because Apex may solve advanced gaps, but it is not the first choice when a native declarative feature fully handles the requirement. B (Validate the outbound change set.) is not enough:
Deployment tooling moves or validates metadata; it does not create the runtime business behavior itself. C (Use a metadata package set.) handles a different concern; it handles only part of the requirement and leaves the controlling Salesforce behavior unresolved. In a real org, the builder should include negative testing as well, proving that the rule does not fire or display outside the intended conditions.
---