Release primary Worker candidate through dedicated workflow

.gitea/workflows/production-candidate.yml

@@ -1,6 +1,9 @@
 name: Deploy primary production Worker candidate
 
 on:
+  push:
+    branches: [astro-platform-pilot]
+    paths: [.gitea/workflows/production-candidate.yml]
   workflow_dispatch:
 
 jobs:

docs/cutover-runbook.md

@@ -20,8 +20,10 @@ static assets to a distinct Worker.
 - Existing Pages production deployment: `2fb1b659-5928-4470-bb04-ef4c9105b843`
   from the `main` branch.
 - Preview Worker: `3031023-xyz-www-preview`, with no custom domains or routes.
-- Production candidate Worker: `3031023-xyz`, deployed only through the manual
-  `Deploy primary production Worker candidate` workflow.
+- Production candidate Worker: `3031023-xyz`, deployed only through the
+  dedicated `Deploy primary production Worker candidate` workflow. Its push
+  trigger is limited to changes to that workflow file; ordinary site commits
+  cannot update this Worker.
 
 ## Cutover sequence (requires separate approval)