ci: Adopt shared release for the central digest package

.github/workflows/release-digest-package.yml

@@ -0,0 +1,30 @@
+name: Central digest package release
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: Protected package environment
+        type: choice
+        required: true
+        options:
+          - digest-package-release
+          - digest-package-test
+      operation:
+        description: Package release operation
+        type: choice
+        required: true
+        default: verify
+        options:
+          - verify
+          - deploy
+          - rollback
+permissions: {}
+jobs:
+  release:
+    if: github.ref == 'refs/heads/main'
+    permissions:
+      id-token: write
+    uses: QuantStrategyLab/.github/.github/workflows/deploy-azure-blob.yml@0d5360a64974a25514e32da2f645b032614e367d
+    with:
+      environment: ${{ inputs.target }}
+      operation: ${{ inputs.operation }}

docs/unified-daily-notification.md

@@ -385,3 +385,15 @@ bindings or turn a disabled target into a verified zero-activity window.
 Future broker-side confirmation is described in
 [Fill confirmation design](fill-confirm-design.md). It is design only and grants no
 runtime, broker, deployment or notification authority.
+
+## Shared Azure package release
+
+Run `Central digest package release` from the default branch. Select the
+protected package environment and start with `verify`. For a release, stage
+the reviewed ZIP by its SHA-256 in the private container, configure the two
+digests, then select `deploy`. The shared workflow verifies the backup,
+updates the live package conditionally, and reads it back. Use `rollback`
+with the same digest pair when the candidate is still live. The Azure
+send and check schedules keep their existing package path and runtime identity.
+
+[Organization package release contract](https://github.com/QuantStrategyLab/.github/blob/main/docs/deployment-workflows.md#azure-blob-packages)