ci: release and update with release-actions and quarto-workflows

[mcanouil]

The workflows now use the shared actions from mcanouil/release-actions and the shared updater workflow from mcanouil/quarto-workflows.

• Release: token with require-app: true gives the App token, and land pushes the bump.
  The release title is {date}{count}, so the title step goes.
  The branch guard and the recovery step go as well, because land and bump now refuse those cases themselves.
• Image build: update-docs checks out the default branch with the App token, and land opens the transcript pull request with auto-merge.
  It passes base, because a release event runs on the tag.
• Documentation deploy: the setup-git-user@main step goes, since nothing in that job pushes.
• Extension updates: the job calls the shared quarto-extensions-updates.yml@v2 with quarto-version: pre-release.

Please merge this only after release-actions v1.4.0 is out, since the base input of land arrives there.
actionlint passes on every changed workflow.