[jjziets]

Fleet administrators can switch individual managed services between Pinned and Follow stable. Opted-in services select verified stable releases within the installed major version; installation remains a separate manual Update action. Existing pins are preserved by default. The same policy is available through the CLI and a daily host-side selection check.

Paired Proxy source: PR28, commit 6e5186401e78cc8ba7b6ffe18eb24712ef9263b1.

Validation on DC head 24e7e3985c8345f220550fe7a69a5bd75cad0325:

• Image CI, Python package CI, native verification, and documentation CI passed.
• CI wheel and source archive match all 11 guarded DC policy/owner/unit files. The image receipt binds the actual runner and the prospective merge, whose tree equals this reviewed head.
• Native fixture preflight binds this DC head and the paired Proxy commit. Named-volume/bind flows, scoped updates, failed-health rollback and interrupted adoption pass. Production issuer, real discovery and external cleanup acceptance remain explicitly held in its receipt.
• Local native-route tests: 12 passed, including tamper rejection. Policy regression: 293 passed. Broader local run: 2,125 passed; eight sandbox-blocked Prometheus cases passed on replay with loopback access. Three unchanged UI cases were blocked before browser startup by the Mac sandbox.
• Correctness/security reviews passed. Dev integration preserves both approved authority-document sections and newer GPU changes exactly.

This remains a draft source candidate. Activation on LTX and Charlotte/BBmaint requires the separate legacy-recovery prerequisite, operational trusted signed publisher/catalog, normal main release and final site acceptance. The existing IPMI1.4.1/Proxy1.6.2 deployments are separate completed repairs. This PR has not deployed the new controls.