v0.2.0: PR mode, sticky comment, glob model verified against Ruby

Pull request mode

--base <ref> (Action: pr-mode: "true", base:, or comment: "true") reports only the gaps a pull request introduces; exit code and counts follow those alone. Optional sticky PR comment (comment: "true"): created once, updated in place, skipped for forks, never fails the job. CI proves exactly one comment after two runs on a same-repo PR.

Glob model checked against real Ruby

The directories glob model was rewritten and is now differentially tested against Ruby's Dir.glob(..., File::FNM_DOTMATCH) (the call dependabot-core makes): 47 hand-picked patterns identical; random fuzz 9/20000 mismatches, all of the shape x/**/**/. This corrected README claims from 0.1.0 (/**/* and /apps/* also select the root / /apps itself). See "Glob model vs real Ruby" in the README for scope and limits.

Dependabot's own pipeline was not run; only the glob expansion is verified.

Marketplace: action.yml has name, description, branding and inputs; publishing to the Marketplace is a manual step by the repo owner.