- promoted ActionPin from MVP to publishable CLI
- added text, JSON, and SARIF output modes
- added severity thresholds, output files, config discovery, allowlists, and ignore rules
- added optional GitHub API enrichment for workflow defaults and environment protections
- added a composite GitHub Action wrapper and CI usage examples
- added local tests for scanning, config handling, SARIF generation, and enrichment