[codey] Track bundled Action dist

[Conalh]

Summary

• fixes the bundled Action runtime packaging bug from v0.1.15
• stops ignoring dist/ and commits the built CLI files that action.yml runs from published tags
• adds a regression test that verifies the published Action path does not install/build and that key dist files are tracked
• bumps README/package metadata to v0.1.16

Root cause

PR #29 made the composite Action execute $GITHUB_ACTION_PATH/dist/index.js, but .gitignore still ignored dist/ and no dist files were tracked. That meant the published v0.1.15 tag did not actually contain the bundled CLI expected by the Action runtime.

Verification

• node --test test/workflow.test.mjs (red before tracking dist, green after)
• npm run build
• npm test (37/37)
• node dist/index.js audit --repo . --format json (rating none, 0 findings)
• node dist/index.js audit --repo test/fixtures/conflicted --format github
• git diff --check
• git diff --cached --check