Add HK verify-only Cloud Run dispatch

[Pigbibi]

Summary

• Add a manual workflow_dispatch target hk-verify for an isolated HK dry-run Cloud Run service.
• Default the HK verify dispatch to hk_listed_global_etf_rotation, paper execution mode, dry_run_only=true, SEHK/HKD/XHKG market settings, and the hk-verify account group.
• Add workflow-dispatch hints to the switch-plan JSON and document the explicit deployment command.

Validation

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/sync-cloud-run-env.yml"); puts "yaml ok"'
• /tmp/qsl-ibkr-ci-venv/bin/python -m pytest -q tests/test_runtime_config_support.py
• bash tests/test_sync_cloud_run_env_workflow.sh
• /tmp/qsl-ibkr-ci-venv/bin/python -m compileall -q scripts tests
• git diff --check
• /tmp/qsl-ibkr-ci-venv/bin/python -m pytest -q

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d66761ff8a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Sync HK env before first deploy

When target=hk-verify is dispatched with the default deploy_image=true, this branch enables both deploy and env sync, but the workflow later runs Build, push, and deploy Cloud Run image before Sync Cloud Run environment. For a new isolated HK verify service, the container starts without the env values this new step only writes into the later sync plan; main.py loads runtime settings at import time and runtime_config_support.resolve_account_group raises if ACCOUNT_GROUP is absent, so the first gcloud run deploy can fail before the env-sync step ever applies these defaults. Consider passing the required HK env during deploy or performing the initial env update before deploying a new hk-verify service.

Useful? React with 👍 / 👎.