feat: GitHub Action check mode

[MarkAlex1234]

Summary

action.yml          composite: npx go-tokenless@<pinned> --json (read-only) -> action/check.mjs
action/check.mjs    plan -> ::warning/::error annotations, job summary (fixes + npm trust commands), output `status`;
                    check mode exits 1 for `ready` (token still used) or `blocked`

• Inputs: mode (check|report), working-directory, read-token.
• CI: a new action job dogfoods uses: ./ on this repo and expects already-tokenless.
• Release workflow: the repository variable RELEASE_AS_DRAFT=true leaves the next GitHub release as a draft. Releases are immutable, and the Marketplace checkbox is set by a human when publishing, so this keeps that step possible.
• README: a new "Keep it tokenless in CI" section, and the contents list is regenerated.

Why: research found only 5 Marketplace results for "npm trusted publishing". A check mode keeps the tool running after the migration, which retains users and shows the tool in every repo that adopts it.

Evidence

yarn check: 86/86 tests pass, including tests/action.test.ts: a token workflow fails with annotations and a summary, report mode passes, and tokenless or no-publish repos pass. A test keeps the pinned npx version in step with package.json.

Merge danger

Door: two-way

Blast radius: additive; the CLI is unchanged.