Ephemeral test/clone servers (role=ephemeral-test). Teardown requires its own
dual-channel security authentication and can only ever delete ephemeral test servers.
Step-up identity
Teardown is OTP-gated; enter the internal user's email so the codes
route to that operator's enrolled factors.