v1.0.9 — delegate to riskratchet v0.3.2

Delegates to KayhanB21/riskratchet@v0.3.2 —
"the adopter's first hour". The floating v1 tag now points here.

This upgrade matters if you use the Action. 0.3.2 fixes two defects that hit adopters directly:

• The Action could fail on first adoption. With no baseline yet it runs
  check --fail-above --format pr-comment, which emitted every function above the threshold with no
  cap. Past GitHub's 65,536-character comment limit the upsert step got a 422 and failed the job
  instead of posting a report. The comment is now collapsed and hard-capped.
• Churn was silently scoring zero. The quickstart snippet used a bare actions/checkout, which
  defaults to a depth-1 clone — git log --since then sees only HEAD, so CI disagreed with a
  locally-generated baseline with no error anywhere. The README snippet now sets fetch-depth: 0;
  add it to your workflow if you copied the old one.

Note: the delegated ref had drifted — it sat at v0.3.0 through the whole 0.3.1 cycle, so anyone
on floating v1 was running 0.3.0. Fixed here.