actions list/info: add trust level, publisher, paths, policies, and compatibility metadata

[Copilot]

actions list was missing publisher and actions info/show was missing several metadata fields called out in the PRD: trust level, pack path, compatibility, policies, and full security details.

Changes

actions list

• publisher added to every row (text + --json)
• search now also matches on publisher text

actions info / actions show

• trust level — derived field (high/medium/low) from the manifest's security block:
  • high: leastPrivilegePermissions=true + pinThirdPartyActions=required + allowPullRequestTarget=false
  • medium: leastPrivilegePermissions=true + allowPullRequestTarget=false
  • low: anything else
• pack path — CatalogEntry.packDir (absolute path to the pack on disk)
• Compatibility section — providers, languages, package managers, frameworks
• Policies section — installMode, managedComment, requiresReview
• Security section — all four security fields, explicit
• --json output now includes packDir and trustLevel

New export

export function deriveTrustLevel(security: ActionPackManifest['security']): TrustLevel

Tests — 5 new unit tests covering deriveTrustLevel logic and subcommand presence.

Example output (actions info node-pnpm-ci)

Node pnpm CI (node-pnpm-ci@1.0.0)
Least-privilege Node/TypeScript CI workflow using pnpm — install, typecheck, test.

publisher:    profullstack
visibility:   public
license:      MIT
categories:   ci, node, typescript
pricing:      free
trust level:  medium          ← green/yellow/red coloured
pack path:    /…/packages/actions/node-pnpm-ci

Compatibility
  providers: github
  languages: javascript, typescript
  package managers: pnpm
  frameworks: next, sveltekit, react

Policies
  install mode:     pull-request
  managed comment:  true
  requires review:  true

Security
  least-privilege permissions:  true
  pin third-party actions:      optional
  allow pull-request-target:    false
  default timeout (min):        15
…

[alwaysmeticulous]

Meticulous was unable to execute a test run for this PR because the most recent commit is associated with multiple PRs. To execute a test run, please try pushing up a new commit that is only associated with this PR.

_{Last updated for commit f505900. This comment will update as new commits are pushed.}