feat: add composite action for GitHub Marketplace listing

[wei18]

Summary

• Add a root action.yml (composite action) wrapping the existing discovery/reviewer/synthesis/report actions, so Upkeep can be published to the GitHub Marketplace (which only lists actions with action.yml at repo root) and consumed as - uses: wei18/upkeep@v2.
• Add a "Or as a Marketplace action" section to README.md documenting the new usage path alongside the existing reusable-workflow one.
• The existing .github/workflows/audit.yml reusable workflow is untouched and remains the primary integration path — see docs/en/why-reusable-workflow.md.

Known limitation (by design, documented in the action and README): a composite action runs as a single job with no strategy.matrix, so the 7 reviewers execute sequentially instead of in parallel. Each reviewer step is marked continue-on-error: true to preserve fault isolation (one reviewer failing doesn't block the rest), but wall-clock time will be longer than the reusable-workflow path for repos with several reviewers enabled.

Test plan

• action.yml parses as valid YAML (python3 -c "import yaml; yaml.safe_load(open('action.yml'))" — OK)
• actionlint not available in this environment; not run
• Every step maps back to a job/step in .github/workflows/audit.yml (see review comment for the mapping table)
• End-to-end run against a real consuming repo (only verifiable after merge + a tag, by the repo owner)

🤖 Generated with Claude Code