Your team is constructing a GitLab CE CI/CD pipeline to deploy an Ansible-based network automation solution. Requirements: linting must run first on every commit, the playbook must be validated against a CML simulation before touching production, and production deployment must only occur on the main branch and require a human approval. Which pipeline design correctly satisfies all these requirements?