Rolling deploys on an owned backend: health checks, drain, and rollback

A restart is not a deploy. If you own the process, the load balancer, and the artifact, a production ship is a cutover: new instances must prove they can serve, old instances must stop taking work wit