ci: shallow checkout with on-demand base fetch (issue #306, B5)

[ShixiangWang]

Summary

Issue #306 item B5 (Checkout 减负): the "Github Page" deploy workflow checked out the full ~5 GB git history (fetch-depth: 0) on every build, but its change-detection step only ever needs two commits — HEAD and the base SHA.

• fetch-depth: 1 in quarto-publish.yml build-deploy checkout.
• The change-detection step now fetches the base SHA on demand: git fetch --no-tags --depth=1 origin "$BASE_SHA" before git diff.
• Fail-soft: if the base fetch fails (e.g. force-push removed the base commit), the step falls back to today's "full build" behaviour (need_julia=true, need_python=true, has_changes=false) instead of failing the workflow.

Why date-modified: last-modified is safe (verified, not assumed)

_quarto.yml sets date-modified: last-modified on every page. Before changing anything I verified whether Quarto resolves this from git history or from the filesystem:

• Rendered a test .qmd with date-modified: last-modified and set the file's mtime to 2020-01-01 while git log reported 2026 → Quarto rendered "January 1, 2020".
• Conclusion: Quarto uses the file mtime, not git history. actions/checkout preserves mtimes on shallow clones, so displayed dates are unaffected by this change.

Other behaviours verified

• git diff --name-only --diff-filter=ACMR "$BASE_SHA" HEAD works in a real shallow clone after the on-demand fetch (tested locally against a constructed shallow repo).
• The workflow's "Commit updated dependency files" step (commit + push from a shallow checkout) works — tested commit+push from a depth-1 clone.

What was deliberately NOT changed

• ci-benchmark.yml keeps fetch-depth: 0 — the benchmark exists to measure cold-cache full builds and legitimately needs full history.
• quarto-publish-update-cache.yml keeps fetch-depth: 0 — it commits and pushes dependency-update commits to main; keeping the full clone there is the conservative choice for a workflow that runs weekly and doesn't pay the ~1 min checkout on every PR.

Expected benefit

• Deploy/PR builds skip the full-history clone (~5 GB .git → depth-1), saving roughly 1 min per build and a large amount of egress/disk churn on every "Github Page" run (the most frequently run workflow in the repo).

Test plan

• PR CI ("Github Page" pull_request run) passes with shallow checkout + on-demand fetch — change detection output matches expectations
• After merge, the main push deploy runs green and the live site is unchanged

🤖 Generated with Claude Code

[github-actions]

✅ QMD Format Check

No new QMD tutorial files to check.

Automated check by the PR Review workflow.
See contribution guidance for the expected tutorial format.