Release policy

Signed updates, reviewable activation.

Tester separates bug intake, release verification and appliance activation so a report or failed process cannot silently replace running code.