Strict Renewal Policy: Automated bulk renewal (`certbot renew`) is permanently forbidden. In Phase 3, renewals are executed individually with mandatory pre-flight dry runs and explicit admin approval. Private keys are never exposed.