Install exact managed payload from Machine Git baseline, prove Direct helper and zero-healthy source with isolated state, verify production runtime unchanged, then close and publish both Machine Git trees.