v2.2.1 — bundle decoupled from package.json

No rule changes; a build-integrity fix.

The action bundle inlined the entire package.json (esbuild does that when source does require('../package.json')), so unrelated manifest edits — a new script, an allowScripts entry — changed dist/action.js and reddened the bundle-drift job three times in one day.

The version is now injected via esbuild's define, making the bundle a pure function of the source. Verified by adding a throwaway package.json field, rebuilding, and confirming dist came out byte-identical.

src/ ships to npm where that define does not exist, so safeVersion() falls back to a runtime readFileSync — which esbuild cannot inline, keeping the bundle decoupled while making the unbundled path report the real version instead of 0.0.0. That path is not reachable today (src/action.js is neither bin nor main), but it ships and should not be a trap.

114 tests pass.