Just wondering how does buildkite handle this
You could use block steps to stop a pipeline before the steps that perform the deployment. Someone would have to hit that button to allow the deploy to happen.
And afterwards, you could add a block step between the deploy and a rollback step to allow someone to verify the deploy and if it has errors can hit the block button to allow the pipeline to continue to the rollback step.
Does something like that fit your case?