the way to go here is probably creating an "administrator" account which is used by those merging scripts, and allow push access to protected branches for administrators.
If the feature is deemed good, an ‘admin’ will ‘finish’ the feature and it is merged into develop branch.
Then, when we are ready for a release, the ‘admin’ will create a release and both develop and master are updated.
Updating master triggers a webhook that deploys the release.
For a hotfix, the release step is skipped, but both develop and master are updated, again causing the webhook to trigger a deployment.