v0.2.0: PR mode with sticky comment, better targetSdk resolution

What's new

• PR mode (issue #1): --base REF and the Action inputs pr-mode, base, comment, github-token. Only findings the pull request introduces are reported and can fail the build (matched by rule, file and normalised source line, not line number). comment: true keeps one sticky pull request comment up to date (created, updated in place, skipped for forks).
• targetSdk resolver (issue #2): precompiled script plugins matched by plugin id, convention plugin classes matched by alias, multi-line findVersion(..) and dotted catalog accessors, shared root scripts such as common.gradle, lowest value across product flavors; build-plugin directories are no longer mistaken for apps.

Verified

• 41 tests pass; CI green on Ubuntu/Windows/macOS (Python 3.9, 3.11, 3.13), wheel build, Action self-test, the released v0.1.0 consumed from the tag.
• PR mode and the sticky comment ran in CI on the pull request that introduced them (Linux and Windows): exactly one comment existed after two runs.
• Corpus (100 public repos): 6 more modules got a targetSdk, all 6 checked by hand and correct; unresolved fell from 29 to 21 of 143 modules.

Not verified

• No Android runtime test; recall is unmeasured; the sticky comment was tested on same-repo PRs only (fork behaviour is a unit test, not a live run).
• Marketplace listing is a manual step for the repository owner.