Automate Quarto site publishing via GitHub Actions using a render/freeze verification script

[mgraffg]

Blocked by

Blocked by #45 — that issue documents how to preview/render the Quarto site
locally (quarto preview, quarto render from quarto/). This issue builds
automation on top of that manual workflow, so it should not be worked until
#45's documentation has landed and the manual steps are confirmed correct.

Purpose

Automate publishing of the Quarto site (quarto/) on push to main,
following the same render → freeze → publish pattern used by
INGEOTEC/AprendizajeComputacional:
a local script renders the notebooks and verifies the committed _freeze/
cache is in sync before anything is pushed, and GitHub Actions publishes
straight from that frozen cache — without installing the scientific Python
stack in CI.

Observed pattern (AprendizajeComputacional)

• _quarto.yml sets execute: freeze: auto, so Quarto only re-executes a
  page whose source changed since its _freeze/ entry was committed.
• scripts/render.py is run locally (inside the devcontainer, which has
  Quarto installed) before pushing. It:
  • installs any missing rendering dependencies from requirements.txt,
  • runs quarto render over the site,
  • verifies every page's frozen result the way Quarto's freeze mechanism
    reads it: source hash matches, and every figure the frozen markdown
    references actually exists under _freeze/,
  • warns if the local Quarto version differs from the one pinned in the
    publish workflow,
  • reports which paths changed (_freeze/ + any changed pages) so the
    author knows what to git add/commit.
• .github/workflows/publish.yml triggers on push to the default branch
  (plus workflow_dispatch), installs only Quarto (no Python/conda), and
  runs quarto-dev/quarto-actions/publish@v2 targeting gh-pages. Because
  the freeze cache is already committed and in sync, CI never needs to
  execute notebook code itself.

CompStats already has execute: freeze: auto in quarto/_quarto.yml and a
tracked quarto/_freeze/ cache, so this issue is about adding the missing
pieces (the local render/verify script and the push-triggered, freeze-only
publish job), not introducing freezing from scratch.

Plan

1. Add scripts/render.py (repo root), adapted from
   AprendizajeComputacional's version for CompStats's site shape
   (quarto/index.ipynb + quarto/pages/*.ipynb, listed from the navbar
   entries in quarto/_quarto.yml rather than a book's chapter list):

   • --verify-only to just check the committed cache,
   • --force [pages...] to drop frozen results and re-execute,
   • --skip-deps to skip the requirements.txt install check,
   • checks the local quarto --version against the version pinned in
     .github/workflows/publish.yml,
   • verifies each notebook's _freeze/<page>/execute-results/html.json
     hash matches the current source and that referenced
     _freeze/<page>/figure-html/* assets exist,
   • prints git status --porcelain for quarto/_freeze and the notebooks
     at the end, so the author knows exactly what to commit.

2. Update .github/workflows/publish.yml:

   • trigger on push: branches: [main] in addition to the existing
     workflow_dispatch,
   • add a concurrency group (e.g. website) with cancel-in-progress,
   • drop the conda-incubator/setup-miniconda step and the full
     numpy/scipy/scikit-learn/... install — CI will rely entirely on the
     committed freeze cache,
   • keep quarto-dev/quarto-actions/setup@v2 (pin the same version
     scripts/render.py checks against) and replace the manual
     quarto publish gh-pages --no-browser shell step with
     quarto-dev/quarto-actions/publish@v2 targeting gh-pages.
   • CompStats's pages don't use Mermaid diagrams, so the headless-Chrome
     setup step from AprendizajeComputacional's workflow is not needed here.

3. Document the local step: note in the repo (README or
   CONTRIBUTING-style doc, alongside whatever Documentar cómo previsualizar el sitio Quarto y la documentación de docs/ desde develop #45 adds) that
   python scripts/render.py must be run and its output committed
   (quarto/_freeze/ + any changed notebook) before merging to main,
   since pushing to main now publishes automatically from whatever freeze
   cache is committed at that point.

4. Verify end-to-end: on a branch, deliberately change a notebook,
   run scripts/render.py, commit the updated freeze cache, merge to
   main, and confirm the publish.yml run picks up the change and
   deploys without installing Python.