Make deployment identity names environment-specific end to end

An isolation policy can forbid shared service identities while rollout code still hardcodes the shared service name, producing a configuration that can never pass its own preflight. Centralize an environment-to-identity mapping and use it everywhere: target lookup, fleet inventory, topology validation, private endpoints, variable checks, mutation plans, and operator output. Add regression tests that reject other environments’ namespaces while allowing only an explicit legacy identity during migration. This does not require separate names when environments live in separate projects with truly disjoint identities.

Applies when: deployment tooling manages several environments inside one hosting project. Keywords: deployment isolation service identity namespace preflight Railway rollout validation