Migrate release + image-build workflows to the shared reusable workflows

[dcmcand]

Summary

Migrate the template's release.yaml and image-build workflow off their hand-rolled implementations onto the shared reusable workflows in nebari-dev/.github, matching what llm-serving-pack already uses:

• nebari-dev/.github/.github/workflows/pack-release.yaml@v1
• nebari-dev/.github/.github/workflows/pack-build-image.yaml@v1

The template is the canonical copy-paste reference for pack authors, so it should demonstrate the current, standardized release-engineering pattern (an easy on-ramp), not a bespoke one.

Note: this pattern only works for official packs in the nebari-dev org. The reusable workflows sync charts into nebari-dev/helm-repository (→ quay.io/nebari/charts) and push images to quay.io/nebari/*, using org-provided secrets (NEBARI_HELM_REPO_TOKEN, QUAY_TOKEN, QUAY_USERNAME). Forks outside the org need their own publishing infrastructure.

Current state

• release.yaml: manual workflow_dispatch; helm package → GitHub Release → maintains a self-hosted Helm index on the template's own gh-pages branch. This contradicts the template's own docs, which tell authors to publish to the central nebari-dev.github.io/helm-repository. (The docs site deploys to Cloudflare Pages, so gh-pages is used only for this index.)
• build-image.yaml: hand-rolled docker/build-push-action; tags :latest + :<full-sha>; triggers only on examples/auth-fastapi/app/** and the Dockerfile.

Target

• release.yaml → thin caller of pack-release.yaml@v1 for the auth-fastapi example (the one example with a first-party image, so the only one that meaningfully exercises tag-paths image pinning). Triggered on push to main when examples/auth-fastapi/chart/Chart.yaml changes.
• build-image.yaml → build-images.yaml → single job calling pack-build-image.yaml@v1 (copying the llm-serving-pack structure). Also triggers on the chart's Chart.yaml so the release commit produces the sha-<short7> image the release workflow pins to. image: auth-fastapi-example keeps the GHCR path identical to today's image and to the chart's values.yaml; Quay is added as a mirror.
• Update README + docs to describe the new flow and drop the self-hosted gh-pages index wording.

Scope notes

• Only auth-fastapi is wired to releases. basic-nginx (upstream nginx) and wrap-existing-chart (podinfo subchart) have no first-party image to pin and stay as-is.

Prerequisites

• NEBARI_HELM_REPO_TOKEN, QUAY_TOKEN, QUAY_USERNAME available to this repo (org-provided to public nebari-dev repos; this repo is public).

Acceptance criteria

• release.yaml calls pack-release.yaml@v1 with chart-path, chart-name, tag-paths, NEBARI_HELM_REPO_TOKEN.
• build-images.yaml calls pack-build-image.yaml@v1; old build-image.yaml removed.
• Self-hosted gh-pages Helm-index logic removed.
• README + docs describe the reusable-workflow flow and the official-packs-only constraint.
• Workflow YAML lints clean; helm lint/helm package succeed for the auth-fastapi chart.