Well, I don't know that we necessarily can.  I think there's a conceptual problem with assuming the integrity of a system when designing exception-handling for its use.

The build might fail during or before the creation of the deployment object or any of its nodes, or even after the nodes are created but before they are appended to the deployment object.

I think it seems like a safer and simpler assumption to assume that we can't rely on an intact deployment object existing or the destroy subcommand working.  Also, there's the issue of getting a fully fledged deployment object into any exception-handing method further down the stack.