Preflight the deployment control plane before publishing an image
Before publishing an expensive immutable candidate, validate the target supervisor contract, operator privilege boundary, registry-read path, canonical environment and secret ownership, checkpoint ownership, and rollback artifact. A green image pipeline proves artifact quality, n…