ci(action): drop jq dependency, guard gh, declare Node >=20 engine

[Conalh]

Addresses review findings #8 and #9.

#8 — Action portability

The composite Action parsed the PR event payload with the standalone jq binary (base SHA, PR number) and invoked gh unconditionally for the sticky comment. Both ship on GitHub-hosted Ubuntu but can be missing on self-hosted / minimal runners, failing the step hard.

• Drop jq: read the PR base SHA and number from GITHUB_EVENT_PATH with Node (always available — this is a Node action), each wrapped in try/catch so a missing/malformed event degrades to empty instead of aborting under set -e.
  • The gh api --jq … filter is gh's built-in jq, not the binary, so it stays.
• Guard gh: wrap the sticky-comment block in command -v gh; when gh is absent, emit a ::notice and skip rather than fail — the Markdown report is already in the step summary.

#9 — Node engine

Declare "engines": { "node": ">=20" } in package.json and keep the lockfile's root entry in sync, so running the CLI on an unsupported Node version surfaces a clear error. (agent-gov-core already requires >=20.)

Tests

Verified the Node extraction snippets behave (correct values; empty on missing file). New tests assert the action no longer uses the jq binary for the event, reads it via process.env.GITHUB_EVENT_PATH, guards gh with command -v, and that both package.json and the lockfile declare the engine. All 120 tests pass.

🤖 Generated with Claude Code