v0.1.3 — HN-readiness polish

No engine changes. Scan header no longer prints the version (sample outputs in docs can never go stale; azt --version still exists). README gains a zero-install reproducible demo (clone, scan the malicious fixture, watch it exit 1). CI gains a stranger-path test consuming the Action via the published tag — proof that uses: ralfyishere/agent-zero-trust@<tag> works outside this repo.

Checked: full suite, CI green on both Python versions including both Action jobs (local-path dogfood + published-tag). Not checked: Marketplace listing (manual checkbox on the release page, owner's call).