v0.17.3 — Action symlink-escape hardening

Security (GitHub Action only): block symlink escape past GITHUB_WORKSPACE. A config file tracked as a symlink could be retargeted in a PR to point outside the checkout; for lenient formats (CSV/.env) the target's contents would be read and posted into the public PR comment. The Action now resolves each changed file with realpath and skips (with a warning) anything outside the workspace. The npm CLI (dist/) is unaffected. The moving v1 tag now points here. Thanks to @anupamme (#5).