0.1.9: a review with fail-on off no longer reddens the build

The Action now comments without gating, which is what fail-on: off always promised.

Getting here took four attempts on this repository's own pull request, and each one exposed a different broken assumption: the floating tag did not resolve, the bundle needed a node_modules that a checkout does not have, a failed step reported green because of continue-on-error, and finally findings at exit 1 reddened a job that was only asked to comment. Attempt 4 is green with seven annotations on the lines that caused them.

• exit 1 means findings and no longer fails the job; only an exit above 1 (the tool could not run) does
• an empty JSON report after a clean run is treated as a failure
• a checkout path containing a space now fails with an instruction instead of a module-not-found