As you stated, requirements will differ based on company and industry policy; for us, the adjustment from "separation of duties" to automated deployments has been rough. As interim steps, we've started:
Requiring multiple "sign-offs" before deployment; this is accomplished by both reviews for the PR in Azure DevOps and an audit log in ...
You can use when: on_failure, in your case you can create a new job for rollback when your some more tests have failed.
- cleanup build when failed
For more example: https://docs.gitlab.com/ee/ci/yaml/#when
Octopus can now be launched in a docker container in linux -
Octopus Server Linux Containers launched as part of 2020.6 and it's our recommended way to use containers with Octopus Deploy. You will need to upgrade to 2020.6 before using the Octopus Linux Container....
Your use case is very simple, so relying on GIT_STRATEGY=fetch is probably sufficient and as you said the default behavior.
You should be cautious using artifacts unnecessarily as they are uploaded to the gitlab server.
The answer to your question generally depends on a few things, like the size of your repository, network connection, runner executor type, ...