fix(actions): resolve capture core from action checkout

[noah-ing]

What

Resolve the bundled agentrust-capture-core package from the composite action checkout for the Cursor, Copilot, Gemini CLI, and Windsurf actions, and add a regression test to the validation workflow.

Why

For a remote action such as uses: agentrust-io/integrations/cursor@<ref>, GITHUB_WORKSPACE points to the caller's repository, not the checkout containing the action. The current install command therefore looks for packages/agentrust-capture-core in the consumer repository and fails unless that unrelated path happens to exist.

${{ github.action_path }} identifies the checked-out action directory. Resolving ../packages/agentrust-capture-core from there keeps the package and action on the same referenced revision and avoids crossing into caller-controlled workspace content.

The new regression creates separate action and consumer checkout trees, places a decoy package path in the consumer tree, and verifies all four actions resolve only the bundled package from the action checkout.

Test plan

• python -m pytest tests -q — 28 passed
• Cursor, Copilot, Gemini CLI, and Windsurf engine suites — 100 passed total
• python scripts/validate_integrations.py — 35 integrations, 0 failures
• python scripts/validate_compatibility.py — 0 failures
• marketplace and AGT catalog generation checks — current
• repository Ruff command — passed
• nox — all 14 isolated sessions passed
• detect-secrets 1.5.0 on changed files — 0 findings
• git diff --check and git fsck --full — passed

DCO

The commit is signed off under the Developer Certificate of Origin.

Author name correction

My full name is Noah Ingwers (@noah-ing). The original commit a00d391 incorrectly used Noah Ing in its author, committer, and Signed-off-by fields. Those entries refer to me, Noah Ingwers.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[carloshvp]

Reviewed exact head a00d391b60c233a3cb351aca7c06649c7861a4be. All four composite actions now resolve capture-core from their own action checkout, keeping the package on the same referenced revision.

Validation: repository tests 28 passed; integration validation 35 integrations, 0 failures; compatibility validation 0 failures. I also executed each rendered install command in bash with a pip argument-checking stub, separate action/consumer directories, and paths containing spaces; all four selected the action's package. This was a local shell check, not a newly dispatched hosted Actions run. No blocking findings; existing substantive CI is green.

[imran-siddique]

Reviewed all four composite actions and the CI regression. The dependency now resolves from the action checkout at the referenced revision. All four regression cases pass with separate action and consumer directories; restoring the old action files makes all four fail.