v0.1.0-beta.2 — critical Action input fix

v0.1.0-beta.2 fixes a critical input-parsing bug found by the first live consumer smoke test of beta.1, and supersedes v0.1.0-beta.1 for any shadow evaluation.

Critical fix: Action inputs were unreadable on real runners

The GitHub Actions runner exports inputs with dashes preserved (github-token becomes INPUT_GITHUB-TOKEN), but the Action read underscore names (INPUT_GITHUB_TOKEN). On real runners every input was therefore unreadable: github-token fell back to empty (the Action aborted with "GitHub token is missing"), while fail-on, create-check-run and check-name silently fell back to defaults. Local unit tests missed this because they injected the same underscore names the parser read.

The parser now prefers runner-native dashed names with underscore fallbacks, locked by regression and precedence tests. The repository's own Shadow Gate failures previously attributed to the documented non-ready boundary were caused by this same bug; those runs never reached evaluation and their evidence is void.

Other changes

• Corrected the beta.1 release-notes consumer reference from the invalid daichunghy/patchgate/action@<SHA> subpath form to the root daichunghy/patchgate@<SHA> form (the runbooks were already correct).
• Migrated action.yml from node20 to node24 per the runner deprecation.
• Findings record: docs/reviews/2026-08-22-live-smoke-findings.md in the repository.

Consumer reference (shadow, non-blocking)

- name: PatchGate beta shadow gate
  uses: daichunghy/patchgate@edab0ece5dd404bbe05cd349d60d9ccb190b57c8
  with:
    fail-on: never
    create-check-run: true
    github-token: ${{ github.token }}

Pin to this full commit SHA; do not treat a branch reference as immutable.

Verification

Fresh-checkout npm run verify at the tagged commit: lint, typecheck, budget/pin/event/doc-link/community/dossier checks, audit (0 vulnerabilities), 138 tests (94 unit including 16 action tests with runner-native input names, 14 security, 25 GitHub integration, 5 CLI process), clean-room action bundle, consumer fixture and release-candidate checks all pass; public CI (Node 20/22, ubuntu/macos), CodeQL and Dependabot runs pass on the same commit. Maintainer smoke repository: daichunghy/patchgate-beta-smoke.

Beta status unchanged: pre-release for shadow evaluation; not production-declared, not externally piloted, and blocks merges only where a maintainer configures it as a required status check with an expected-source setting.