Build-only CI, pull-based deploys, stateless targets that never hold source. Source control, the CI runner, the container registry and the deploy daemon all run on infrastructure this estate owns outright rather than a third-party pipeline service, and the two-stage design keeps them from ever trusting each other more than necessary: one stage builds and tags an image on every push to the main branch, and a completely separate daemon on the production side decides, independently, when to pull that tag, verify it, and bring it up. No credential capable of reaching production ever exists inside a build job. Production targets hold no source code and no build tooling at all — they pull a finished container and run it, nothing more. This is not a case study about someone else's infrastructure: it is the estate's own production pipeline, proven across more than ten live products, covering build, security scanning, deployment, health-gating and automatic rollback, at an infrastructure cost that stays marginal against a single commercial CI subscription.