Implement Downstream Notification Workflow and Script (Phase 2 A.2)

Labels: quartz, phase-2, workflow
Parent: Phase 2 A: Downstream Subscription and Notification
Blocked by: Phase 2 pre-A (subscriber.yml schema and notification granularity agreed)

Implement the outbound notification workflow and the script that dispatches to
downstream subscribers via Quartz Conveyor.

Tasks

• notify-downstream.yml: triggered on relevant TheRock status changes; reads
  config/subscriber.yml; calls scripts/notify_subscribers.py; no job-level
  permission elevation needed (read-all default is sufficient, Conveyor App token
  handles outgoing dispatches)
• scripts/notify_subscribers.py: reads config/subscriber.yml, resolves any
  secret-based subscriber entries at runtime, filters subscribers by the triggering
  event, sends workflow_dispatch to each subscribed workflow via Quartz Conveyor app

Notes

• The trigger condition and subscriber filtering logic follow directly from the
  subscriber.yml design agreed in Phase 2 pre-A.

Start with the subscriber.yml schema and notification granularity from Phase 2 pre-A, then inspect the existing workflow layout before adding notify-downstream.yml and scripts/notify_subscribers.py. Done means relevant TheRock status changes trigger the workflow, subscriber.yml entries are resolved and filtered by event, and each subscribed workflow receives a workflow_dispatch through the Quartz Conveyor app.