A cloud engineering team has a CI/CD pipeline that automatically builds, tests, and deploys code to production whenever a merge to the main branch occurs. After a recent incident where an untested schema change reached production, leadership requires that changes to the production environment receive human sign-off while keeping all lower-environment deployments fully automated. Which change to the pipeline BEST satisfies this requirement?