v1.0.2 — npm v12 compatibility, transitively

Ships six commits that had been sitting on master unreleased — including both
halves of the npm v12 fix. Anyone pinning @v1 has been getting the pre-#13
action since 2026-07-12.

Fixed — npm v12 compatibility

npm v12 blocks git dependencies by default.
This action installed truecopy over git, so once runners move to npm 12 it would
have failed at the install step for every consumer.

• #15 — install from truecopy's signed release tarball for release refs
  (v0.9.0+), falling back to git for branches and bare SHAs, with --allow-git
  added on npm ≥ 12. No breaking change: every existing truecopy-ref still
  resolves. Also adds opt-in verify-attestation, which runs
  gh attestation verify --owner askalf and refuses to install on failure.
• #13 — default truecopy-ref moved off v0.8.0, which was two minors
  behind the scanner.
• #16 — default is now v0.10.1, and that specific version matters:
  truecopy 0.10.0 still declares @askalf/redstamp as a git dependency, so
  installing 0.10.0 from a tarball only moves the git dep one level down and npm
  12 still refuses. 0.10.1 is the first release that is git-dep-free
  transitively.

Other

• #10 — OpenSSF Scorecard badge points at api.scorecard.dev
• #11, #12 — grouped GitHub Actions dependency bumps

Upgrading

Nothing to change. askalf/truecopy-action@v1 now resolves here, and the
truecopy-ref contract is unchanged — a tag, branch, or SHA all still work.
Pinning the full SHA remains the airtight option.