Clone dev into envs/staging and envs/prod, deploying to namespaces dbiz-staging and dbiz-prod on the same cluster. App names suffixed per env, destination namespaces + external-services namespaces + ingress hosts adjusted. Monitoring kept as a single cluster-wide stack in dev (not duplicated). Sealed secrets left empty pending per-namespace re-seal (sealed secrets are namespace-scoped).