Canary pipeline should use a verified release or use the github-resource

[chrisfarms]

What

The canary's pipeline should pull from a release of the canary or use the gitub resource to authenticate commits.

Why

To prevent someone with write access to this repo bypassing two-eyes process

[chrisfarms]

#747