Migrate preview.yml to gha's split-trust preview family (blocked on gha#607)

[d-morrison]

Second leg of #81, split out because it is blocked upstream.

preview.yml here is hand-rolled: it renders the site and deploys via rossjrw/pr-preview-action in a single job holding contents: write and pull-requests: write. Morrison-Lab/gha publishes a split-trust replacement — a read-only preview.yml build half that uploads an artifact, and a preview-deploy.yml half that runs in the base-repo context via workflow_run and does the writing.

Blocker

gha's preview composite installs R but has no r-packages input, so a Quarto site that is neither an renv project nor an R package cannot get knitr/rmarkdown/DT onto the runner. That is this repo exactly. Filed as Morrison-Lab/gha#607.

Once unblocked

1. Replace preview.yml with the gha caller stub: use-renv: false, install-package: false, setup-chrome: false, r-packages naming knitr/rmarkdown/DT, and a trimmed apt-packages list (the default carries JAGS and the whole renv stack, none of which this site needs).
2. Add preview-deploy.yml.
3. Add check-equation-renders.yml. This is the one worth the whole exercise: it crawls the rendered preview with a headless browser and catches equations that fail to typeset. MathJax renders client-side, so a broken macro produces a clean Quarto build and a visibly broken page — the exact failure mode this repo exists to avoid, and the one nothing in CI currently detects.
4. Add cleanup-pr-previews.yml to prune stale gh-pages preview directories.