Design the rollback strategy for a platform deploying 50+ times per day across many independent but interdependent services.

Cover: per-service independent rollback capability (immutable, SHA-tagged images make 'redeploy the previous version' a known-good, fast operation) without requiring a coordinated multi-service rollback in the common case; automated rollback triggers tied to post-deploy health/SLO signals rather than relying solely on manual detection; careful handling of the cases where a rollback isn't safe in isolation (e.g., a schema migration already applied that the previous app version can't handle) by ensuring the backward-compatible migration pattern discussed earlier is the default practice; and feat