Open pull requests. Approve one to merge + deploy to production. Every action is gated (auth + confirm) and logged.
What's live, what's merged but not yet deployed, and whether it was validated on staging. Read-only.