v0.1.1

[0.1.1] - Marketplace listing + App-token publishing

Added

• GitHub Marketplace listing. The Action now lives at the repository root and is
  published as "Egret Security" on the Actions Marketplace. Reference it as
  NX1X/Egret@v0 (floating major) or a pinned @v0.1.1.
• App-token publish features. New action inputs github-token, check-run,
  pr-comment, and dashboard-issue: pass a GitHub App installation token to publish
  a branded pass/fail check, a sticky PR comment, and the Egret Security Dashboard
  issue as egret-security-app[bot] (each opt-in; falls back to GITHUB_TOKEN).

Fixed

• Action install checksum verification now hash-compares the downloaded binary
  directly, so install no longer fails closed on a valid release (the binary is
  saved under a different on-disk name than the SHA256SUMS entry).
• SARIF results always carry a location (fall back to a suggested policy path),
  which GitHub Code Scanning requires - SARIF uploads are no longer rejected.

Changed

• Go toolchain 1.26.5 (clears the crypto/tls, net/textproto, and x509 stdlib
  advisories); codeql-action v4, checkout v7, setup-go v6, refreshed base-image digests.
• Release notes are now sourced from this CHANGELOG.