In reply to Alec Kinnear.

Webhooks would mean automatically deploying the release. To allow for a manual, click to confirm push, you would need to use the API not the webhooks, which would mean granting WordPress.org the same "repo" permissions as listed above.