feat(github-action): default severity-threshold to none (report-only)

[Rome-1]

Summary

• Flips the GitHub Action's severity-threshold default from high to none so a first install scans, comments, and uploads SARIF but never fails the build.
• Adds a one-line tip to the PR comment when findings exist under the report-only default, pointing users to severity-threshold: high for opt-in enforcement.
• README updated: features list now says "report-only by default", input table reflects the new default with guidance, and a new "Enforce in CI (recommended after first scan)" example block leads the examples.

Why

Rafter spans SAST + SCA + secrets where false positives are common. The previous default (high) meant any first install on a real repo would likely fail CI on day one — the worst possible first impression, and one that gets the action removed before users see the value. This aligns with how Snyk, CodeQL, and Semgrep default: surface findings through PR comments + the Security tab, and let teams opt into blocking once they've triaged the baseline.

Behavior change for existing users

• Users who set severity-threshold explicitly in their workflow: unaffected.
• Users who relied on the implicit high default: their builds will stop failing on critical/high findings. They'll see the new tip in the PR comment and can restore prior behavior with severity-threshold: high.

Test plan

• Workflow consumer with no severity-threshold set → scan completes, PR comment includes the tip when findings exist, build does not fail.
• Workflow consumer with severity-threshold: high set → fail-on-high behavior preserved.
• Workflow consumer with severity-threshold: critical set → fail-on-critical behavior preserved.
• SARIF still uploads to the Security tab in all cases.

Security review

rafter agent reviewed the diff — verdict GO, no findings. The new SEVERITY_THRESHOLD env var passthrough uses the GitHub-recommended env: block pattern (not template interpolation into the script body); the new echo line is a static string; the none branch of the threshold-evaluation step already no-ops, so the default change has no logic regression.

🤖 Generated with Claude Code