If it's not behind XX:+UnlockExperimentalVMOptions (or a preview/incubator module), it's considered stable and prod-ready, yes. Will there be fixes and improvements? Yes. Should you be afraid to use it for business? No, but obviously test it first.

You can buy support from Redhat, which would presumably include support for their JDK build with Shenandoah.

Not sure what that means in practice, but if someone is putting money on the line, it must be worth _something_.