Regarding your question about supporting an automated, time-based freeze of metadata before a production release, the platform does not currently provide this feature set.
Change & Edit Control
The platform does not support a configurable time or system/configuration feature to allow one or more partners to freeze metadata changes.
The permissions for checkout/edit/merge are not fine-grained, and likely don’t support this use case. If a developer’s security role was revoked to prevent metadata edits, this would take effect for all environments the developer has access to which may not be desirable.
Promotion / Deployment Control
The platform does not currently provide a feature to control promotions for a tenant by time window, environment state, configuration flag, or pre-promotion validation hook that could be used to condition promotions.
Automation & Scheduling
You should not create scheduled jobs that are designed to mutate metadata objects such as permissions or roles.
This is a very valid request, and my recommendation is to get this formally added as a backlog Idea to have platform support considered. I would suggest a call/discussion to ensure the use cases are clear in terms of which pipeline environments need to have the restrictions implemented, and any that do not. It would also be helpful to better understand the automatic scheduling requirements.
