feat(action): publish marketplace metadata at repo root

[mrwogu]

Summary

GitHub Marketplace lists only the repository-root action.yml. This adds
a byte-identical root copy of action/action.yml, makes
comarch/git-byline@v1 the primary reference, and keeps the
subdirectory reference working for existing callers. The validate scans
stage now fails when the two copies drift.

Scope

• User-visible behavior: the composite action is reachable as
  comarch/git-byline@v1; comarch/git-byline/action@v1 is unchanged
• Interfaces or compatibility: same inputs, same steps, same moving v1
  tag; no breaking change
• Documentation: README, action/README, SECURITY_MODEL, SUPPLY_CHAIN,
  and RELEASES updated
• Generated artifacts: none; action/action.yml is hand-maintained, not
  PromptScript output
• Security and privacy: no runtime behavior change; one new validator
  contract comparing two files inside the repository

Related issue

N/A

Validation

go test ./tools/validate/ -run 'TestCheckActionMetadata|TestCheckScans' -count=1
  ok github.com/comarch/git-byline/tools/validate 0.820s

go run ./tools/validate
  ok gofmt, vet, test, coverage, build, deps, imports, installers,
  promptscript, scans
  validate: all 10 stages passed

Checklist

• Focused change with unrelated refactors excluded
• Tests added or updated
• Documentation updated when behavior changed
• Generated artifacts regenerated and reviewed (none generated)
• PromptScript sources updated instead of generated files (none touched)
• No secrets, private data, or unsafe fixtures included
• Security impact considered
• Breaking changes documented (none)
• Release impact understood (next release needs the marketplace
  checkbox ticked; first publish needs the Developer Agreement and 2FA)

[coderabbitai]

Warning

Review limit reached

Next included review available in 29 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: comarch/git-byline/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f8ba15ae-f44d-439b-aa8e-89c6ebf52bfb

📥 Commits

Reviewing files that changed from the base of the PR and between b4f2820 and b2f9955.

📒 Files selected for processing (8)

• README.md
• action.yml
• action/README.md
• docs/RELEASES.md
• docs/SECURITY_MODEL.md
• docs/SUPPLY_CHAIN.md
• tools/validate/scan.go
• tools/validate/scan_more_test.go

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!