The fix was to create a second updates feed, this one is available at: https://dobrado.net/testing. Now when an update is built, a post is created in this feed. I still write the post to the original updates feed at https://dobrado.net/updates, but these posts are now saved as a draft with a scheduled publish time. At the moment that time is set to 24 hours later. Of course my publishing tools didn't have a concept of draft posts so I had to add that too... next I need to add UI support to make this feature available to users, at the moment it is only used by the Autoupdate module.
Lastly I added support for removing updates. This needs to happen so that the current version number can be re-used rather than leaving the current broken version in place. Sites that are subscribed to the testing feed will also need to re-apply the update at the current version number, and this is done by the build server removing the matching post in the feed. When the Autoupdate module sees that the post was removed from the feed, it will remove the matching version of the update. This means it will be able to install that version again when it is eventually re-published. The draft post also needs to be removed on the build server, but after that anyone subscribed to the updates feed will never know there was a problem.
So now I have a couple of servers subscribed to the testing feed, and the others that I really don't want to break when I build an update are subscribed to the normal updates feed.