fix: improve workflow run discovery

[chenrui333]

Summary

• fetch recent workflow runs without status filters, then filter active runs client-side
• account for GITHUB_RUN_ATTEMPT and current-run timing when selecting previous runs
• clear npm audit findings and fix small README/workflow hygiene issues

Notes

• Regenerated dist/index.js with esbuild.
• Release/tag movement for v3 remains a follow-up after merge.