Security hardening follow-ups (docs + input bounds)

[samarthputhraya]

Lower-severity items from the pre-public security audit (none exploitable in the current model — defense-in-depth):

1. Document that the Action's modelpin-spec input accepts arbitrary pip specifiers (incl. git+), so it's a trusted input — guide users to pin a release tag.
2. Bound/validate the --fixtures path.
3. Cap config-file size to avoid a DoS on a huge modelpin.yaml.