Migrate workflows to Morrison-Lab/gha reusable workflows

[d-morrison]

All four workflows in this repo are hand-rolled stock templates. Morrison-Lab/gha publishes reusable equivalents of every one of them, so this repo should call them instead of maintaining its own copies.

What's here now

File	Current	gha equivalent
claude.yml	stock anthropics/claude-code-action@v1 template	Morrison-Lab/gha/.github/workflows/claude.yml@v2
claude-code-review.yml	stock template, auto-review on every PR sync	Morrison-Lab/gha/.github/workflows/claude-code-review.yml@v2
publish.yml	hand-rolled Quarto render + JamesIves/github-pages-deploy-action	Morrison-Lab/gha/.github/workflows/quarto-publish.yml@v2
preview.yml	hand-rolled render + rossjrw/pr-preview-action	preview.yml + preview-deploy.yml (blocked, see below)

What the migration buys

• Trusted-author gating on claude.yml. The current file fires on any @claude mention from anyone, with no author_association check. gha's caller stub gates on OWNER/MEMBER/COLLABORATOR before the reusable workflow is even invoked.
• Write permissions for the agent. The current claude.yml grants contents: read, so the agent cannot push a branch or open a PR — it can only comment.
• The Morrison-Lab/ai-config plugin, installed by default in both gha agent workflows, so the bot follows lab conventions.
• Per-PR review concurrency managed inside the reusable review workflow, and a workflow_dispatch re-review path that the current stock file has no equivalent of.
• Pinned action SHAs throughout, versus floating @v4/@v2 tags here.
• Serialized gh-pages deploys (concurrency: gh-pages) and a report-failure job that files an issue when publishing breaks.

Cross-owner secret caveat

This repo is d-morrison-owned and gha is Morrison-Lab-owned, so secrets: inherit yields an empty token. Every secret must be passed explicitly in the caller stub. CLAUDE_CODE_OAUTH_TOKEN is already set on this repo.

Preview migration is blocked upstream

gha's preview composite installs R but offers no way to install arbitrary R packages: it supports use-renv (renv lockfile) or install-package (R CMD INSTALL .), and nothing else. This repo is neither an renv project nor an R package, yet macros-table.qmd needs knitr, rmarkdown, and DT. quarto-publish.yml already has the r-packages input that would cover this; preview.yml does not.

Tracked upstream; the preview leg stays hand-rolled until that input exists. check-equation-renders.yml — a headless-browser MathJax render check, which is precisely the failure mode a LaTeX-macro repo cares about — hangs off the preview build artifact, so it is gated on the same upstream change.

Plan

1. Migrate claude.yml, claude-code-review.yml, and publish.yml now.
2. Leave preview.yml alone until the upstream r-packages input lands.
3. Follow up with preview.yml + preview-deploy.yml + check-equation-renders.yml + cleanup-pr-previews.yml.

[d-morrison]

Working on this --- paws off until I'm done.

[d-morrison]

Leg 1 shipped in #83 (merged as e2e94d4). claude.yml, claude-code-review.yml, and publish.yml now call Morrison-Lab/gha's reusable workflows at @v2.

Closing this in favour of #82, which carries the whole remainder as a standalone issue: preview.yml, preview-deploy.yml, check-equation-renders.yml, and cleanup-pr-previews.yml. That leg is blocked on Morrison-Lab/gha#607 — gha's preview composite has no r-packages input, so a Quarto site that is neither an renv project nor an R package cannot use it.

One thing found along the way and filed separately: Morrison-Lab/gha#611, on quarto-publish force-pushing gh-pages while sharing no concurrency group with preview-deploy.

Not done: no automated review ran on #83. Removing the pull_request trigger from claude-code-review.yml takes effect on the branch that removes it, since pull_request events run the workflow file from the PR's own head ref — so the PR removed its own review path. Copilot's ruleset-driven review had not posted when the PR was merged. A self-review is on the PR thread. Post-merge, the first Quarto Publish run under the new workflow is exercising the migration on main now.