There are lots of systems that allow you to set rules for what is required to merge a PR, so if you want "the tests pass, it's a TXT record, the author is whitelisted to change that record" or something, it's very achievable
If it's just because your DNS is at a provider, you should be aware that it's possible to self-host DNS.
Someone will fuck up accidentally, so production zones are usually gated somehow, sometimes with humans instead of pure automata.
Giving write access does not mean giving unrestricted write access
Also, another way (which I built in a previous compagny) is to create a simple certificate provider (API or whatever), integrated with whatever internal authentication scheme you are using, and are able to sign csr for you. A LE proxy, as you might call it
For the other case perhaps renew the cert at a host allowed to do outside queries for the dns challenge and find some acceptable automated way to propagate an updated cert to the host that isn't allowed outside queries.