v2.1.0 — the plan diff in the comment

Installs py-tirith 1.2.1 (was 1.2.0).

The planned changes now render in the comment

Above the findings table, so a reviewer sees what is changing next to the rules that judged it:

```diff
+ aws_s3_bucket.analytics                          create
    + bucket = "analytics-not-a-demo-bucket"
    + tags = {"Demo":"...","Name":"...","Owner":""}
```
Plan: 1 to add, 0 to change, 0 to destroy. 2 unchanged.

Built from the masked plan document on your runner, never from terraform show output — masking is
the only thing keeping a value terraform marked sensitive out of a comment anyone with repository
access can read. Keys and values pass a fence guard, so a value of ``` cannot close the block.
Unchanged resources are counted rather than listed, and the block is dropped first if the comment
exceeds its size limit, because the findings are the point and the plan is context.

This applies in both modes, since the diff is rendered locally from the plan you supplied.

Richer result messages — local mode only

before:  `""` is empty
after:   [aws_s3_bucket.artifacts (no-op)] tags.Owner: `""` is empty

Platform findings are unchanged. They are produced by StackGuardian's evaluation step, which pins
its own CLI, so moving this action's pin cannot alter their text. They gain the wording when that step
image is rebuilt and its revision re-registered.

Also in 1.2.1: a resource skipped through error_tolerance no longer erases the verdict of resources
evaluated before it.

Upgrading

Nothing to change but the ref. Verdicts, exit codes, inputs and outputs are identical.

- uses: StackGuardian/tirith-iac-governance-action@v2.1.0

v2 is untouched and still installs 1.2.0. Each tag pins one CLI, so nothing moves under a
pipeline that did not ask for it — pin @v2.1.0 when you want this.