refactor(ci): extract shared AWS-credentials retry into a composite action

[blairham]

Summary

• Extract the three-shot configure-aws-credentials retry (try / sleep 30 / retry / sleep 60 / retry) — which survives the first-colocation race with Crossplane minting the per-service xp-<svc>-gha-push role (pinpredict/trading#616) — into a new composite action actions/configure-aws-with-retry.
• chart-release.yml and docker-release.yml each drop ~35 lines of duplicated (and already comment-drifted) retry steps down to a single uses: step. Net −92/+85 lines, retry logic now in one place.
• Action inputs: role-to-assume (required), aws-region (default us-east-1). The matrix.role || secrets.AWS_ROLE_ARN fallback and env.AWS_REGION stay caller-side (secrets aren't readable inside a composite action), so the un-migrated-service fallback is unchanged.
• Referenced as pinpredict/.github/actions/configure-aws-with-retry@main (matching the org convention for the other composites) rather than ./actions/... — these reusable workflows check out the consumer repo, so a local ./ path would resolve against the caller and fail (the trap documented in actionlint.yml).
• README composite-actions table updated per the editing playbook.

Test plan

• actionlint (repo-pinned 1.7.7) clean on both edited workflows
• YAML parses for the action + both workflows
• pre-commit hooks pass on commit
• Runtime path exercised via a draft PR in a consumer repo (e.g. service-template) pointing its release uses: at this branch — actionlint can't reach the composite-action resolution at runtime