The client launches their own site from a hostname that does one thing

A dev team wraps a deploy POST in a GET so anyone with the QR can ship. You wrap one so the client can, and nothing else.

Launch day is a hostname. A proxy alias called launch points at your container's curl service; its target_path holds the entire wrapped request, and allow_path_override is false, so the name can't be bent into any other call. Behind it, an exec script re-points production from the old container to the approved one.

The client gets the URL, not an account. When their CEO opens it at 9:14 on Tuesday, the site goes live at 9:14 on Tuesday. You're at lunch.

A magic link was a shortcut for engineers. Aliased and locked, it's a button you can hand to someone who has never seen a terminal.

The launch button is a hostname with one job.