Add GHA-1 composite action

[fstepho]

Summary

Adds the initial GHA-1 composite AnchorMap Action runtime.

The action orchestrates the published AnchorMap CLI without redefining CLI behavior:

• installs Node and anchormap@1.2.2 by default;
• runs scan --json;
• runs check --scan ... --policy ... --json and preserves policy exit code 5;
• optionally runs diff --base ... --head ... --json when base-scan is explicit;
• runs report --format markdown;
• exposes action outputs and appends the canonical Markdown report to the job summary;
• uploads only generated local workflow artifacts when enabled.

Boundaries

No Action tag, release, Marketplace publication, PR comments, SaaS upload, bundle, JUnit, SARIF, baseline inference, or GitHub App behavior is included.

Checks

• npm test
• npm run lint:shell

actionlint was not available in the local environment.