The team template has a gardener

Every team template rots. The base image ages, the dependencies drift, and six months in, "clone the template" hands a new developer a machine that needs a morning of fixes.

This one has a gardener. A weekly cron fires an agent run on the template container: update packages, rebuild, run the test suite, hit the sample app's URL. Only when everything holds does it snapshot: template-week-34, expiry ninety days. If the update breaks something, it restores the last good state and files a report instead of a broken template.

Developers keep cloning a machine that was verified this week, not configured last spring. Nobody owns "update the dev environment" as a chore, because the environment updates itself and proves it.