Make the GitHub Action install example work from a consuming repository

## Priority

P2 — focused reliability or product improvement

## Context

Portfolio audit follow-up (2026-09-08). The Action setup documentation uses a local ./ reference that is not a usable remote installation for outside consumers. The next milestone should demonstrate the actual pull-request workflow, including restricted fork permissions.

## Starting points / evidence

`README.md` Action example and the repository Action entry point. Related cache repair should preserve unknown lookup status in the rendered report.

## Implementation scope

Document a verified existing release/commit reference for JesseRWeigel/lockfile-diff, checkout/base/head prerequisites, least required permissions and npm/pnpm usage. If there is no release, pin a real commit and describe release preparation separately. Provide an output/artifact fallback when a fork PR token cannot post comments. Do not solve this with untrusted-code execution under pull_request_target.

## Acceptance criteria

- [ ] An isolated consumer fixture can run the documented Action against distinct base/head lockfiles.
- [ ] References resolve; no invented version tag or self-repository ./ assumption remains.
- [ ] Read-only fork PR permissions still produce a useful job summary/artifact.
- [ ] Comment-capable runs update their prior report instead of spamming duplicates.
- [ ] Fixtures cover npm and pnpm monorepos with direct/transitive and peer-dependency changes.

Keep the change focused on this issue. Use synthetic fixtures for sensitive data and mocked providers for automated tests; do not require paid model calls to run the regression suite.

Start with the README.md Action example and the repository Action entry point, then verify how the documented reference, checkout inputs, permissions, summaries or artifacts, and comment updates behave from an isolated consuming repository. Use synthetic npm and pnpm monorepo fixtures with mocked providers to cover direct, transitive, and peer-dependency changes; done means all acceptance criteria pass without untrusted-code execution or paid model calls.

Written by the indexing model from the issue text.