Adds a Marketplace-compatible composite GitHub Action for running the AP duplicate-payment CSV audit on authorized, sanitized exports. Includes a synthetic sample workflow and JSON report output. Findings are review leads only, not proof of overpayment.