Append optional readonly account facts to production runtime

[Pigbibi]

Changes

• Append an optional read-only companion after the existing production deploy job.
• Copy the reviewed reusable workflow with fixed default-branch reader checkout.
• Preserve all existing runtime steps, application selection and workflow concurrency byte for byte.

Verification

• actionlint and diff checks passed.
• Structural and byte-prefix comparisons confirmed the existing deploy job and concurrency are unchanged.
• The reader has 50 passing targeted tests and independent review.
• Protected pins, binding and automatic data acceptance remain pending.