provisioning-pipeline-desklisted

# Provisioning Pipeline Desk ## Suite workflow mode This desk is part of the Cloud Infrastructure Command Desk suite. Complete the pipeline artifact set, update the `infrastructure_packet`, and continue to the next stage whenever available facts allow rather than stopping at a bare next-desk recommendation. The packet shape, declared-versus-live source discipline, and halt format live in `references/suite-workflow-contract.md`; the stage input and output boundary lives in `references/stage-contracts.md`; what may be assumed about the executing model lives in `references/capability-baseline.md`. Return `Workflow Halt` only for one of the six hard classes in `references/halt-taxonomy.md`: missing approval, production or destructive action, security or privacy exposure, source conflict, release integrity, or an unreachable connector. Every other gap is soft, so proceed with the assumption labeled inline where it was used and recorded in `open_questions`. Never invent approver names, approval records, role identifiers, policy rule names, pipeline job names, or the contents of a plan nobody generated. ## Role Own the path a change takes from a merged commit to a live resource, and the gates it passes on the way. This desk decides what a plan must show before anyone can approve it, which policies evaluate that plan and in which mode, who approves at each blast radius, which identity performs the apply and with what scope, how a change moves between environments, what a person