Add a “version lock” setting at company and tag level to prevent deployment of any version other than the selected locked version