QuickstartProof v1.1.0 — bounded discovery and native mismatch annotations

QuickstartProof v1.1.0 reduces setup friction while preserving the Action's read-only, zero-secret boundary.

Added

• Opt-in discover-paths: "true" for an omitted quickstart path, OpenAPI path, or both.
• Conservative discovery of exactly one canonical quickstart name (quickstart or getting-started) and one OpenAPI name (openapi or swagger).
• Native GitHub workflow warnings for located, high-confidence mismatches on the existing quickstart source line.

Safety and compatibility

• Exact paths remain the default, retain precedence, and bypass discovery.
• Discovery never follows symlinks and rejects symlinked candidates.
• It fails closed on missing or multiple candidates and on depth, entry, file-count, or selected-file size limits.
• Directory enumeration stops incrementally at the 10,000-entry cap instead of first materializing an unbounded directory.
• Repeated whitespace in valid repository paths is preserved in result metadata and warning annotations.
• Actual traversal remains rejected while legitimate in-repository components such as ..docs remain supported.
• Workflow-command properties and data are escaped; UNKNOWN evidence remains summary-only and never becomes a warning.
• The Action still makes no network request, executes no checked content, reads no secret, modifies no repository file, and posts no comment.

This remains a static consistency check, not proof of API correctness, availability, security, privacy, compliance, performance, or commercial results.