More importantly, I wanted to make sure that Cloud Glider *continued* operating as expected, and that's the part that became increasingly overengineered
It started with this: well, we want to make sure that the propagation launch template used by the glider daemon hasn't mutated, right? So we should bundle that and pin a SHA for the script and AMI, and trigger EmergencyHold if they don't match
But if you give a mouse a cookie, they'll also want to check that the glider daemon itself hasn't mutated, so we'll need to tarball the glider daemon and pin a SHA for that too