Merge to production in four supervised steps.

Shipyard runs the same sequence for every release: visible to the whole team, enforced by gates, and reversible in one click.