v3.1.0 — comment/manifest-dir/vet inputs + more

Feature round bundling five issues (all with tests; suite now 65 checks). Backward-compatible — new inputs default to prior behavior.

• comment input (#2) — comment: "false" = summary-only mode (job summary + outputs + fail-on still apply, PR comment skipped).
• manifest-dir input (#4) — audit a Cargo.lock outside the repo root (monorepos / non-root workspaces).
• cargo-vet interop (#5) — a supply-chain/audits.toml's certified versions are imported as review-ledger sign-offs (new vet input). cargo-vet users get the ratchet for free.
• New capability patterns (#1) — high tier now flags clipboard (arboard/copypasta), input capture / keylogging (rdev/enigo/GetAsyncKeyState/SetWindowsHookEx), and screen/camera/mic capture (scrap/xcap/nokhwa/cpal).
• crates.io links (#3) — crate names in the comment link to their crates.io page.

@v3 points here. Full notes: CHANGELOG.