[codey] Run Action from bundled dist

[Conalh]

Summary

• removes npm ci / npm run build from the published composite Action runtime
• keeps this repo's local dogfood workflow building before uses: ./ so PR branches exercise the current bundle
• documents that consumers run the bundled CLI from the published tag
• adds workflow regression coverage for the prebuilt Action path

Verification

• node --test test/workflow.test.mjs (red before workflow changes, green after)
• npm run build
• npm test (37/37)
• node dist/index.js audit --repo . --format json (rating none, 0 findings)
• node dist/index.js audit --repo test/fixtures/conflicted --format github
• git diff --check