Set one site to one version

The version is a release tag, never latest. To set one site, name its deployment with the required --deployment flag and replace YY.M.D with the published tag — every coordinate comes from deployments/<name>/config.toml, never the shell. The command preflights that the selected brand image and worker image exist, checks the Secret keys before changing Kubernetes, then records the tag in the deployment.

navigator ops ship --deployment <row> --deployments-dir . --tag YY.M.D

curl --fail --show-error https://www.neonlaw.com/version

The #navigator hand-off derives its exact command list from the deployments/ tree — one run per directory, staging first, then the two production rows:

navigator ops ship --deployment <row> --deployments-dir . --tag YY.M.D
navigator ops ship --deployment <row> --deployments-dir . --tag YY.M.D
navigator ops ship --deployment <row> --deployments-dir . --tag YY.M.D

Staging goes first. Do not start either production row until staging /readyz and /version checks pass; the two production rows gate on staging and not on each other, which is why the release run rolls them in parallel. To preview without changing one site, append --dry-run; to refresh its pods after a secret rotation without changing the version, use --restart-only. A deployment can be named here only once it has a deployments/<name>/ directory; that directory is what puts it in this list.