When In-House DevOps Stops Being Enough: Maintaining Production Reliability and Passing Vendor Security Reviews