ci: guard against Quarto extensions serving the wrong document

Surfaced in #392: a Quarto extension with no pinned primary document can silently serve a sibling .md (e.g. CHANGELOG.html) instead of its entrypoint, since Quarto renders CHANGELOG.md (it ignores README.md). No check catches it; everything builds fine.

o prevent this in the future, add a lint-extension check that runs quarto inspect and enforces the standard that a Quarto extension renders only the document it serves: a non-website extension fails if it renders a sibling Markdown page. Websites are exempt (they render many pages and serve index.html by convention). Add a CONTRIBUTING.md note to pin project.render.

Note: This edits shared infra, so CI will lint all extensions. quarto-stock-report-python/-r render a CHANGELOG today, so this PR also pins their project.render (and adds a matching pin to pqr) so they meet the standard. quarto-website legitimately renders many pages and is exempt.