Harden action scaffold inputs and docs

[attomus-gh]

Summary

• Refreshes the README toward Marketplace-ready structure while keeping the current early-development status explicit.
• Adds declared outputs for notify, execute, and bootstrap modes.
• Tightens sensitive-input handling for obvious placeholders and unresolved GitHub expressions while continuing to mask values immediately.
• Exercises the notify send payload path and GitHub repo-secret public-key lookup with focused unit tests.
• Keeps notify runtime blocked until encrypted envelopes can be produced; no speculative recipient-resolution endpoint is introduced.

Verification

• npm run verify
• git diff --check
• naming-neutrality grep over changed files: no matches for prohibited tool-name strings
• gitleaks detect --no-banner --no-git --source . --redact -v

Note: full-history gitleaks detect still reports pre-existing false positives in the bundled dist/index.js from the initial scaffold commit. The current working tree scan is clean.

[attomus-gh]

Superseded by the merged hardening, gitleaks, crypto, dependency, and bootstrap work in #6, #7, #8, #9, and #10. Current main carries the completed behavior and verification.