Run Bicep like packages: pinned versions, one stack per lifecycle
Every Bicep change reaches Azure as a pinned version, previewed and approved, as one deployment stack per lifecycle. A public starter repo runs every check offline in minutes: CI that builds unpublished modules, generated READMEs and snapshots, then what-if on a three-tier landing zone.