Set one site to one version

The version is a release tag, never latest. To preview one site's local plan, name its deployment with the required --deployment flag and replace YY.M.D with the published tag. This offline preview renders local manifests and does not check cloud authentication, IAM, image availability, or live state. A real roll requires the signed image-digest map and live preflight described in docs/manual-roll.md.

: "${NAVIGATOR_DEPLOYMENTS_DIR:?set this to the operator-managed private deployment root}"
: "${ROW:?set this to the selected row name}"
: "${TAG:?set this to the published release tag}"
CONFIG="$NAVIGATOR_DEPLOYMENTS_DIR/deployments/$ROW/config.toml"
set -a; eval "$(grep ' = "' "$CONFIG" | sed 's/ = /=/')"; set +a
host="$NAVIGATOR_PUBLIC_HOST"
navigator ops ship --deployment "$ROW" --deployments-dir "$NAVIGATOR_DEPLOYMENTS_DIR" --tag "$TAG" --dry-run
# For a real roll, first prepare the signed map as described in docs/manual-roll.md.
navigator ops ship --deployment "$ROW" --deployments-dir "$NAVIGATOR_DEPLOYMENTS_DIR" --tag "$TAG" \
  --image-digests "$IMAGE_DIGESTS"
curl --fail --show-error "https://${host}/version"

For each configured row, load its private config and repeat the single-row command after the staging verification passes. The release workflow obtains the rows from the configured external root and gates production on staging.

: "${NAVIGATOR_DEPLOYMENTS_DIR:?set this to the operator-managed private deployment root}"
: "${ROW:?set this to the selected row name}"
navigator ops ship --deployment "$ROW" --deployments-dir "$NAVIGATOR_DEPLOYMENTS_DIR" --tag "$TAG" \
  --image-digests "$IMAGE_DIGESTS"

Staging goes first. Do not start a configured production row until staging /readyz and /version checks pass. To preview without changing one site, append --dry-run; to refresh its pods after a secret rotation without changing the version, use --restart-only. A deployment can be named here only after its private configuration is provisioned under $NAVIGATOR_DEPLOYMENTS_DIR/deployments/<row>/.