Complete procedures with a way back.

Apply Ubuntu security updates through reviewed origins, dry-run the exact unattended policy, schedule APT timers inside a declared maintenance window, and permit reboots only at a known local time when no users are logged in.