A pipeline pins the runner image while the fetched bootstrap script still resolves the latest policy bundle from a mutable channel during a staged decommission

The execution environment is frozen and its policy input is not. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.