[codex] Harden GitHub Action runtime

[Conalh]

Summary

• Convert CapabilityEcho from a composite action that installs/builds before scanning into a prebuilt Node 24 action entrypoint.
• Add src/action.ts to run the existing diff/report engine directly, write step summaries, emit GitHub warning annotations, set outputs, and enforce fail-on.
• Check in the compiled dist/ runtime and update the dogfood workflow to call Conalh/CapabilityEcho@main instead of PR-local ./ action code.

Root cause

The live demo PR showed that uses: ./ plus the old composite action executed npm ci in the PR-local action checkout before CapabilityEcho scanned the diff. That meant a PR adding a malicious postinstall could run before being reported.

Validation

• npm run build
• npm test (14/14 pass)
• node dist/index.js diff --old test/fixtures/capability-drift/old --new test/fixtures/capability-drift/new --format markdown
• git diff --check (exit 0; CRLF normalization warnings only)

Notes

This PR is intentionally scoped to making the free GitHub Action credible as a scanner that does not execute PR-local install/build scripts before review.