The rollout planner needs predictable batches without placing too many instances from one zone together. Implement batching so capacity and per-zone limits both hold throughout the rollout.
Build the implementation in Go under /app, with /app/run.sh as its entry point. Read one JSON request from standard input and write one JSON result to standard output. Input has positive integer max_batch and per_zone, and hosts with unique name and zone. For each batch scan remaining hosts in original order, selecting a host if batch size and that zone count allow; deferred hosts remain for later batches in original order. Return host-name batches until none remain. Reject duplicate host names or invalid limits.
Reject inputs that violate an explicit validation rule with exit status 2, no standard output, and {"error":"invalid_input"} on standard error. For valid input, exit with status 0. Keep the implementation reusable for new inputs; it must work offline and must not depend on the example data being the only data it receives.
Repair or replace the unfinished /app/run.sh and add source files under /app. Malformed JSON must use the same invalid-input response. Do not read /tests or /oracle from the application.