feat: generate a restrict-mode example in the run action's audit report

[dash14]

Summary

The report action's audit-mode Job Summary already includes a ready-to-paste restrict-mode YAML example, generated from the audited hosts via buildRestrictExample (report/src/lib/build-example.js) — so a workflow author doesn't have to hand-copy hostnames out of the table. The run action's own report renderer (run/src/lib/report.js) reads the same report.sections.audited data but never called this, so its audit-mode summary stopped at the audited-hosts table. run/src/main.js already computes actionRef/actionRepo (used only for image provenance verification), leaving them ready to reuse.

This PR closes that gap. Since run is a single self-contained step (unlike setup+report's two-step flow), the generated example is a run@<ref> step with proxy_mode: restrict and the discovered allowlist rules, plus the original run: command preserved so the example stays copy-pasteable on its own.

Changes

• Move buildRestrictExample from report/src/lib/build-example.js to core/lib/build-example.js so both report and run can share it
• Add an actionName/runCommand option to buildRestrictExample — actionName selects setup (existing behavior, default) vs run; when run, the example step also includes a run: | block with the original command
• Wire it into run/src/lib/report.js's buildReportMarkdown/writeReport, passing actionRepo/actionRef/runCommand through from run/src/main.js
• Update docs/reference.md to document that run's audit-mode Job Summary now includes this example, mirroring report's description