feat: add GitHub Actions init and PR annotations

[bm1016bm-svg]

What changed

• add evidrift init --github-actions with npm, pnpm, and Yarn detection
• create an idempotent read-only pull-request workflow and pinned evidrift:check package script
• preserve conflicting user-owned scripts and workflow files
• add escaped GitHub error/warning annotations with affected file and line
• keep --format json machine-readable by writing annotations to stderr in JSON mode
• align package, CLI, Action, and MCP Registry metadata at 0.4.1

Why

Repository setup previously required manual package-script and workflow edits, while CI failures were visible only in logs. This makes first adoption one command and surfaces deterministic drift directly in pull-request checks.

Validation

• npm run verify
• 96/96 tests passed with 0 failures and 0 skips
• end-to-end smoke test passed
• node scripts/verify-release.mjs v0.4.1
• git diff --check

The local Windows run does not claim that the pending Linux/Node 22 GitHub Actions matrix or a live GitHub annotation has passed.

Trust impact

The initializer rejects unsafe workflow paths and never overwrites conflicting user-owned configuration. GitHub workflow command properties and data are escaped; JSON stdout remains a standalone machine-readable report. ReproMin and Receipt semantics are unchanged.