Deploy role

One person deploys at a time, on purpose — so two people cannot push on top of each other. Whoever holds it can push. The other one can still look and validate.

Staged changes

Deploying opens a pull request on GitHub. Merging that PR is what goes live — nothing here publishes on its own.

Result