release: prepare v1.5.1 GitHub Marketplace launch

[paladini]

Summary

Prepare Harness Score v1.5.1 for its initial GitHub Marketplace Action release.

• shorten the Marketplace description to 102 characters
• pin the Action's default CLI version to 1.5.1 instead of latest
• pass Action inputs through intermediate environment variables before Bash uses them
• add an end-to-end CI smoke test for the packaged root Action, including outputs, badge, and Markdown report
• enforce Marketplace description length, root/legacy Action parity, and Action/package version alignment in tests
• replace documented @main usage with the stable @v1 reference across the root README, Action README, and all localized guides
• synchronize the CLI, JSR manifest, lockfile, and both Action entrypoints during version bumps
• document Marketplace categories, release title, and the safe major-tag update sequence

Why

GitHub's Marketplace release form rejected the existing 205-character Action description. The audit also found that consumers were directed to a mutable branch, the Action executed the mutable npm latest tag by default, Action inputs were interpolated directly into Bash, and CI did not exercise the packaged Action itself. The release workflow also publishes npm, GitHub Packages, and JSR for every GitHub Release, so all version surfaces need to stay aligned for the Marketplace release.

User impact

After the release is published and the v1 tag is created, users can consume paladini/harness-score@v1 with reproducible default scanner behavior, safer input handling, and CI-backed Action packaging. Existing action/ consumers remain compatible because the legacy metadata stays byte-for-byte aligned with the root entrypoint.

Marketplace fields

• Primary category: Code quality
• Secondary category: Continuous integration
• Release title: v1.5.1 — GitHub Marketplace launch

Validation

• npm test — 20 files, 268 tests passed
• npm run lint — passed; 18 pre-existing CSS warnings, no errors
• npm run docs:build — passed
• npm run scan -- --min-level 4 — L4, 108/108
• npm run plugins:sync-check — passed
• actionlint v1.7.12 — passed
• local Action package-spec smoke — L4, 100%, badge and Markdown report generated
• npm audit --omit=dev — 0 vulnerabilities
• npm pack -w harness-score --dry-run --json — harness-score@1.5.1, 11 files
• git diff --check — passed

Release boundary

This PR does not publish a GitHub Release, list the Action in Marketplace, or create/move the v1 tag. Those steps remain gated on merge and a successful release workflow.