amOS staged-deploy Phase 3

First real sandbox promote via the guarded controller. No client domain.