In trunk-based development, what controls can teams apply to ensure rigorous approval processes around promotions from test/staging to production?

In gitflow devops (where there is a long-lived unstable branch from which changes are periodically merged into a stable branch, such that the CI/CD can deploy the unstable branch to a development/staging environment and deploy the stable branch to a production environment) one might use BitBucket or GitHub to apply branch protections to the stable branch (such as requiring multiple approvals and passing tests before merging PRs) while permitting developers to push to the unstable branch with less friction (for more efficient cadence in trialling changes through the deployment). However, trunk-based workflows have risen in popularity (whereby the promotion process simply involves tagging the head rather than trying to transplant cherry-picked commits onto a diverged history). How can release tagging workflows incorporate similar protections (i.e., multiple approvers and passing tests) while remaining more permissive for other pushes/merges to that same branch?

For example, are such controls already explicitly supported (in GitHub, BitBucket, or any equivalents), or can it be implemented with only modest gymnastics (like enabling general tag protections plus a manually-approved CI action to create a new tag), or would it require external tooling/interfaces run under privileged service accounts?