Kapable on-prem seal app — served through the real bundle pipeline (provision → artifact-ingest → customer-artifact-deploy) on lantis.