Bundles the work from #7 and #8 into a single commit so trunk lands
release-ready in one merge.

CI / build
- Migrate biome.json to the Biome 2.x schema (`files.includes` with
  negation patterns, `overrides[*].includes`,
  `assist.actions.source.organizeImports`).
- Reorder a stale import in src/deploy.ts that the v2 organizer flagged.
- Pin @actions/core to ^1.11.1 — 3.x is ESM-only and breaks the current
  CJS bundle. Add a Dependabot ignore for major bumps until the project
  is migrated to ESM.

Action UX
- `tags` input now accepts a YAML block mapping (the canonical workflow
  form) or a JSON object string, instead of the prior multi-line
  KEY=VALUE format. Tag keys still merge into the app's existing tags
  on every run.
- Update action.yml description, README, and example workflows to the
  new tag form.

Docs
- Correct the GitHub slug from `spiceai/spice-cloud-deploy-action` to
  `spicehq/spice-cloud-deploy-action` everywhere it appeared (README
  badges + examples, package.json metadata, examples/), so a copy/pasted
  `uses:` line resolves to the published action at v1.
- Replace the duplicated tail-of-document "Required scopes" table with a
  single "Scope cheat sheet" right under the OAuth client setup steps,
  including an "All-in (recommended for a single CI client)" row that
  spells out exactly which scopes to grant.

Tests
- New `parseTags` cases cover the YAML form, JSON form, quoted values,
  duplicates, and validation errors.
- Total: 70 unit tests, all green.

- parseBlockMap duplicate check now uses Object.hasOwn() so prototype-
  chain property names like `toString` and `constructor` aren't falsely
  rejected as duplicates.
- Drop ':' from TAG_KEY_PATTERN. The block-map parser splits on the
  first ':', so a tag key containing ':' (e.g. `foo:bar`) couldn't be
  expressed in YAML form anyway. Aligning the JSON form keeps validation
  consistent across both input styles. Also rewords the validation
  error message to match the trimmed character set.
- Rename the misleading "rejects JSON arrays" test to make clear it
  rejects non-string JSON values; add a separate case for a root-level
  JSON array (which falls through to the YAML parser); add a regression
  test for the prototype-chain dupe-check fix.