sando: refuse unprovisioned promotes, harden the companion path guard, drop the stale hook
sando: build + deploy companion services (mnw-cli) in lockstep