AWS landing zone runner-critical path and ARM spot runners: fast pipelines with security scans in MRs. The rest of the landing-zone foundation (guardrails, runbook) stays in aws-landing-zone's Tier 1: foundation milestone.