[codex] Harden TaskBound action install path

[Conalh]

Summary

Hardens the Action publishing path after the live demo showed the self-dogfood workflow could execute PR-modified npm lifecycle scripts when using uses: ./.

Changes:

• Run npm ci --ignore-scripts and npm run build --ignore-scripts inside the composite Action install/build steps.
• Switch the self-dogfood workflow from PR-modifiable uses: ./ to Conalh/TaskBound@main, while keeping PR title/body task fallback coverage.
• Bump package metadata and README examples to 0.2.0 so the next release tag can match the advertised Action behavior.
• Add workflow tests covering ignored install scripts and the trusted dogfood Action ref.

Root cause

PR #1 intentionally modifies package.json with a postinstall pipe-to-shell script. The self-dogfood workflow used uses: ./, so GitHub Actions evaluated the local Action from the PR merge checkout and ran npm ci from that checkout. The log showed the demo postinstall command executing before TaskBound reviewed the diff.

Validation

• node --test test/workflow.test.mjs passed.
• npm run build passed.
• npm test passed: 22/22.
• git diff --check passed, with Windows CRLF conversion warnings only.