Guarded automatic deploys

Reviewed, tested, deployed and then checked live; any failure stops the release.