Labeled same-repo PRs deploy stage pr-<n> behind the relay-preview environment reviewer gate. Unlabel or close tears the stage down, and a nightly job retries failed teardowns. Runtime-created managed endpoint tunnels and CNAMEs are swept by a PreviewTunnelSweep resource.

Known gaps, tracked as follow-ups: an interrupted preview deploy can leave runtime tunnels behind; repo-level relay secrets still bypass the environment gate until moved.

🤖 Generated with [Claude Code](https://claude.com/claude-code)