fix: load bundled default includes outside project root

[buger]

Summary

Fix extends: default when Visor runs from a GitHub Action checkout where the repository root differs from the action bundle path.

default is a built-in Visor source, so bundled include / extends entries should resolve inside the Visor package/action bundle rather than through project-local config path validation.

Root cause

This regressed in d08f91225371fefd3c65ab9acda2a930c3447d54 (RFC: state machine engine (#245)). That commit extracted code-review defaults from defaults/visor.yaml into defaults/code-review.yaml and added:

include: "./code-review.yaml"

The bundled include was then resolved through the generic local config loader. In GitHub Actions, that validates paths against the checked-out project root, e.g. /home/runner/work/tyk/tyk, so the bundled action path under /home/runner/work/_actions/.../dist/defaults/code-review.yaml was rejected as path traversal.

Changes

• Load bundled default config through a bundled-only loader.
• Resolve bundled include / extends entries only within the bundled defaults directory.
• Keep project-local path traversal validation unchanged for user config files.
• Add a regression test that simulates a project config with extends: default outside the Visor package root.

Verification

PASS tests/unit/config-loader-bundled-default.test.ts
PASS tests/unit/config-loader-default-nondot.test.ts
PASS tests/unit/config-extends.test.ts
PASS tests/unit/config-extends-github-action.test.ts

Also ran eslint and prettier on the touched files.

Note: the working tree had unrelated failing empty-comment tests from a separate investigation (tests/frontends/github-frontend.test.ts, tests/unit/raw-output-extraction.test.ts). They are not part of this PR.