quarto-publish should open an issue when a publish run fails

[d-morrison]

A failed publish is silent. quarto-publish.yml runs on pushes to main, where nobody is watching a check the way they watch one on a PR, so a red deploy sits unnoticed until someone happens to look at the Actions tab or notices the site is stale.

check-links.yml already solves this shape of problem for itself:

      - name: Create issue on main branch if links are broken
        if: failure() && github.ref == 'refs/heads/main' && inputs.create-issue-on-main

so the capability exists in the repo; it is just welded to one workflow.

Proposal

1. Extract the pattern into a shared composite, rather than copying twenty lines of gh issue create into quarto-publish.yml. A second hand-rolled copy is exactly what this repo's own review guidelines call out ("In workflows and composite actions, factor shared logic into reusable units rather than copying it between files"), and there are already two call sites with a third plausible.

2. Give it deduplication, which the existing copy lacks. check-links.yml calls gh issue create unconditionally, so every failing run on main opens another issue --- a recurring or flaky failure produces a pile of identical ones. The composite should look for an open issue with the same title first and comment on it instead, so a repeated failure accumulates evidence in one place.

3. Wire it into quarto-publish.yml behind an input, defaulting on for main, matching check-links.yml's create-issue-on-main default.

4. Migrate check-links.yml onto it, so the extracted unit has its existing caller rather than living alongside the copy it was extracted from. Its current labels (bug,automated,copilot) and @copilot body line become inputs so its behavior is unchanged.

Motivating case

d-morrison/altdoc's deploy workflow went red four times between 2026-07-25 and 2026-07-27 on an unrelated upstream outage (d-morrison/altdoc#60). Every occurrence was found by a person going looking, and each needed a manual re-run. Two of the four were on main, where no PR check surfaces them at all.

Notes

• Needs issues: write on the calling job; README.md's permissions section already documents that requirement for check-links and gains a second entry.
• Doc sync per CLAUDE.md: README.md's workflow table, website/workflows.qmd, website/reference/quarto-publish.qmd, and the examples/ stub.
• Deliberately scoped to quarto-publish rather than every workflow in the repo. A general "any failure opens an issue" would be noisy on PR-triggered checks, where the PR already surfaces the failure.