test(integration): no end-to-end scenario covers INPUT_FAIL_ON_DEPRECATED=true against an EOL ref

## Problem

There is no integration scenario that drives the action with `INPUT_FAIL_ON_DEPRECATED=true` AND `GITHUB_ACTION_REF=v1.3.3` (the EOL ref) AND expects the action to exit 1 with a `::error file=action.yml::` annotation. The smoke tests cover this path (smoke.sh:394-402 Test 20), but only by running the validation script in isolation — not by exercising the full action image, lftp attempt, and EXIT trap.

## Why this matters

Fail-on-deprecated is documented as "Useful for orgs with a 'no EOL versions' policy." A regression that breaks the ::error:: path (e.g., a future refactor of `emit_deprecation_warning` that silently exits 0 instead of 1 on EOL+fail-on-deprecated) would not be caught by an integration test. The smoke test runs entrypoint.sh in a container but cannot exercise the actual workflow run semantics.

## Proposed fix

Add a new scenario `13-fail-on-deprecated-e2e.sh` (or fold into existing scenario 08) that:

1. Boots vsftpd (action needs to talk to a real FTP server to reach the lftp attempt path).
2. Sets `GITHUB_ACTION_REF=v1.3.3` + `INPUT_FAIL_ON_DEPRECATED=true` in the env file.
3. Invokes the action image.
4. Asserts:
- Action exits 1 (not 0).
- Captured log contains `::error file=action.yml::`.
- Mirror did NOT run (no "Try #" lines, no "FTP UPLOADED FINISHED" banner).

Note: the action needs a "dev" VERSION baked into /app/VERSION (or whatever the local build sets) so the deprecation-warning emit doesn't short-circuit on a stale /app/VERSION check.

## Severity

LOW — smoke tests the path; missing only the image-level integration.

## Related

- #231 (open): smoke tests do not cover FTPS — same family of integration-coverage gaps
- #323 (new): INPUT_DRY_RUN end-to-end (sister gap)