create/list/rollback/clean with cm-<ticket>-<label>-<ts> naming,
protected-VM regex (pfv-bms/netinfra/PMG/PBS), Kuma-window gate on
rollback, retention cleaner, local audit log. Verified end-to-end on
tsys5 against throwaway VM 59999 (created, rolled back, destroyed).
https://projects.knownelement.com/issues/769#note-4152