feat: package zc as a reusable action

[gustavovalverde]

zc could only be consumed in CI by downloading mutable main and provisioning moving tool versions separately. This packages the existing analyzer as a composite action that binds each release to a tested toolchain pair while leaving repository-specific changelog and release policy to consumers.

What changes

• Reusable entry point: action.yml runs the existing CLI against an explicit baseline and optional exact head, with opt-in lockfile and value analysis.
• Reproducible environment: the action installs cargo-public-api 0.52.0 and nightly-2026-07-18; CI exercises that same pair and keeps action dependencies current through Dependabot.
• Stable distribution: installation examples use the v0.3.0 release instead of mutable main, and zc --version no longer performs a custom network freshness check.
• Action-level coverage: CI invokes the local action against an isolated Rust fixture before running the existing analyzer suite.

Important

Publish v0.3.0 from the merged commit before advertising the tag-based action and installation examples. Consumers can pin the branch commit for pre-release smoke tests.

The action remains an analysis boundary: it preserves the CLI's exit-code contract and does not write changelogs, interpret repository policy, or orchestrate releases.

AI disclosure: Codex implemented the composite action, tests, and documentation under maintainer direction.

[Copilot]

Pull request overview

This PR packages the existing zc Bash-based analyzer as a reusable GitHub composite action, pinning a tested cargo-public-api + nightly toolchain pair per release, and updates CI/docs to consume the tool via a stable v0.3.0 tag rather than mutable main.

Changes:

• Add a composite GitHub Action (action.yml) that installs pinned tooling and runs zc against a required baseline and optional head ref.
• Update the zc CLI behavior and docs for stable distribution: bump ZC_VERSION to 0.3.0, pin install examples to the v0.3.0 tag, and simplify --version output (removing the remote freshness check).
• Extend CI to exercise the local action against an isolated Rust fixture and keep GitHub Actions dependencies current via Dependabot.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
zc	Bumps release version to 0.3.0, pins prerequisite/tooling guidance, and simplifies --version output (removes update check).
tests/run.sh	Adjusts integration tests to match the simplified --version behavior and improves sed -i portability.
README.md	Documents using ZcashFoundation/zc@v0.3.0 as a reusable action and pins install examples to the v0.3.0 tag.
action.yml	Introduces a composite action that installs pinned nightly + cargo-public-api and runs zc with validated inputs.
.github/workflows/ci.yml	Updates CI to pin action SHAs, run the local composite action against a fixture repo, then run existing tests.
.github/dependabot.yml	Adds Dependabot updates for GitHub Actions with a weekly schedule and cooldown.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.