Audit pinned Python dependencies against PyPI, pause for operator approval, apply upgrades with automatic rollback on smoke-test failure, and recover without re-auditing using examples/pypi_upgrade_guard/actions.py.
