Run production-grade Bastion services with policy guardrails, observability, and staged rollout controls.