Pipelines as code, cherry-picked promotions, and a manifest that remembers the fixes a release earned on its way to production.
Promotion to production blocked on a gate.