Consider changing the promotion steps of Kubernetes deployments

During a recent incident: #661 (closed) we could have protected ourselves from destructive actions by enforcing dry-runs against canary and production to be manual steps. Consider adjusting the pipeline to move the manual promotion to prior to the canary job.