Resolve website images through one shared helper

[cderv]

Follow-up to #15053 and #15032. The listing feed image size lookup missed the project.dir join (#15032) because the same resolve-and-size logic was written by hand in three places, and the per-item copy had the join while the feed-level copy did not. #15053 settled which base each image source resolves against and moved the path half into projectRelativeHref. The URL check, the project join and the imageSize call were still repeated.

resolveProjectImage(image, projectDir, documentDir) in website-shared.ts now does all three: it builds the project relative href with projectRelativeHref, skips the size lookup for web URLs (a URL joined onto a Windows path makes stat throw, #15022), and reads the size from the project file otherwise. The feed-level image, the per-item feed image and imageMetadata call it.

URL building stays at the call sites, absoluteUrl for feeds and joinUrl for page metadata. The helper adds no error handling, so imageSize read and decode errors propagate as before. imageMetadata drops its path field, which nothing read.

The one output change is in the feeds. Relative paths now go through join like page metadata images already did, so ./feed.png gives https://example.com/feed.png instead of https://example.com/./feed.png, and img//feed.png gives /img/feed.png. Paths starting with / keep their href as written. Images outside the project are not supported input and have no handling.

render-listing-feed-image gains a local per-item image in its fixture (image: ../feed.png) and asserts its media:content. Per-item local images had no rendered check, and that assertion passes on the base commit as well.

Checklist

I have (if applicable):

• referenced the GitHub issue this PR closes
• updated the appropriate changelog in the PR
• ensured the present test suite passes
• added new tests
• created a separate documentation PR in Quarto's website repo and linked it to this PR

AI-assisted PR

• AI tool used: Claude Code
• Codebase grounding: local clone
• Human review: I have reviewed, tested, and verified the AI-generated content before submitting.

Note: autonomous AI agents submitting PRs without human oversight are not permitted — see the Code of Conduct.

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.