fix(action): unbreak Marketplace listing + composite-action dispatcher (v1.0.2)

[ylabonte]

Summary

Two Action-side fixes that ship together as v1.0.2.

1. Marketplace listing. Shorten the description field in action.yml from 199 chars to 123 chars so the GitHub Marketplace publish flow accepts it (the constraint is ≤125). Same scope, fewer words:

Turn workflow annotations into dedup-aware GitHub Issues — severity-labeled, won't-fix-aware, auto-closing when noise stops.

2. Composite-action dispatcher reliability. The action self-test surfaced that the published v1.0.1 is broken on ubuntu-latest runners: the bash dispatcher invoked npx -y -p PKG BIN, but on the runner's npm 10.x that form was skipping the install step and falling through to `sh -c "ghaar …"` → `command not found` → exit 127. npm exec --package= exhibited the same fallback behavior.

Replace the heuristic-based forms with an explicit install + direct bin invocation, both inside the existing set +e block so a registry failure still lets the action emit its json / counter outputs:

```bash
ghaar_install=$(mktemp -d "$RUNNER_TEMP/ghaar-install.XXXXXXXX")
set +e
npm install --silent --no-save --no-audit --no-fund --prefix "$ghaar_install" \
"github-actions-annotations-reporter@$GHAAR_VERSION" \
&& "$ghaar_install/node_modules/.bin/ghaar" "${args[@]}"
cli_exit=$?
set -e
```

This bypasses every bin-resolution code path and works identically on npm 10 and 11. No behavior change for callers; the action's inputs / outputs / env contracts are unchanged.

Test plan

• CI green on this branch (Static, Tests, Build).
• Action self-test green for the first time — the in-tree `uses: ./` actually runs the dispatcher end-to-end (it was skipped on every prior run via the pre-publish npm probe).
• After merge, Version Packages PR bumps `1.0.1` → `1.0.2`.
• After Version Packages merge, OIDC publishes 1.0.2 and the floating `v1` tag advances.
• Retry the Marketplace publish flow — the description constraint now passes.
• `uses: ylabonte/github-actions-annotations-reporter@v1` in a clean workflow successfully runs (no longer 127s).

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR shortens the GitHub Action metadata description for Marketplace constraints and also changes how the composite action installs and invokes the published CLI package.

Changes:

• Shortens action.yml description to fit Marketplace listing limits.
• Replaces npx -p ... ghaar with npm install --prefix <tmp> plus direct .bin/ghaar execution.
• Adds a patch changeset documenting the Action-side fixes.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
action.yml	Updates Marketplace description and dispatcher package invocation.
.changeset/marketplace-description.md	Adds patch release note for the description and dispatcher changes.

Comments suppressed due to low confidence (1)

action.yml:219

• This change stops using npx, but the public version input description and nearby dispatcher comments still describe the package as being run via/passed to npx. Please update those references so the action metadata and maintenance comments match the new install-and-direct-bin execution path.

        npm install --silent --no-save --no-audit --no-fund --prefix "$ghaar_install" \
          "github-actions-annotations-reporter@$GHAAR_VERSION"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.