ci: add shared digest candidate release workflow

.github/workflows/release-digest-candidate.yml

@@ -0,0 +1,40 @@
+name: Digest candidate job release
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: Protected release environment
+        type: choice
+        required: true
+        options:
+          - digest-candidate-release
+          - digest-candidate-release-test
+      operation:
+        description: Release operation
+        type: choice
+        required: true
+        default: verify
+        options:
+          - verify
+          - deploy
+          - rollback
+permissions: {}
+jobs:
+  release:
+    if: >-
+      github.ref == 'refs/heads/main' &&
+      (inputs.target == 'digest-candidate-release-test' ||
+       (inputs.target == 'digest-candidate-release' && inputs.operation == 'verify'))
+    permissions:
+      id-token: write
+    uses: QuantStrategyLab/.github/.github/workflows/deploy-job.yml@fcf38f37e25c34580776ef1318718f434286f6e2
+    with:
+      provider: gcp
+      environment: ${{ inputs.target }}
+      operation: ${{ inputs.operation }}
+    secrets:
+      DEPLOY_WIF_PROVIDER: ${{ secrets.DEPLOY_WIF_PROVIDER }}
+      DEPLOY_SERVICE_ACCOUNT: ${{ secrets.DEPLOY_SERVICE_ACCOUNT }}
+      DEPLOY_RESOURCE: ${{ secrets.DEPLOY_RESOURCE }}
+      DEPLOY_PREVIOUS_IMAGE: ${{ secrets.DEPLOY_PREVIOUS_IMAGE }}
+      DEPLOY_CANDIDATE_IMAGE: ${{ secrets.DEPLOY_CANDIDATE_IMAGE }}

docs/unified-daily-notification.md

@@ -99,6 +99,14 @@ notification routes or cloud permissions. It does not establish delivery success
 
 ## Publication before the central daily read
 
+Run the manual `Digest candidate job release` workflow from the default
+branch. The production environment supports `verify`, which reads back the
+pinned Cloud Run Job image through a dedicated short-lived Google identity.
+Deploy and rollback are available for the isolated test environment. The
+workflow does not invoke the producer or change its schedule.
+
+[Organization container release contract](https://github.com/QuantStrategyLab/.github/blob/main/docs/deployment-workflows.md)
+
 GitHub schedule events can start late. A heartbeat workflow is therefore not a
 reliable deadline trigger for the 07:00 Asia/Shanghai read. Keep its existing
 monitoring checks, but run the archive-only publisher independently in an