cg-actions: mirror resolution, SHA-pinning, source-aware updates, and HTML report improvements

[tylerpaxton]

Consolidates a batch of cg-actions improvements into one reviewable PR (supersedes #3, #5, #6, #7, #8; README install already landed via #4). One commit per logical change.

Commits

1. feat: source-aware version check — check_version.py detects whether the skill was installed via Chainguard Agent Skills (.agents/skills/…) vs GitHub and checks the matching source; falls back if one is unreachable; semver-aware compare.
2. feat: SHA-pin hardened refs by default (--pin sha|tag) — migration output now defaults to commit-SHA pins with a # vX.Y.Z comment (GitHub Actions hardening best practice); --pin tag opts back to tags.
3. fix: resolve mirrors via org index — resolves chainguard-actions/* mirrors against an index of all public repos (case-insensitive, subpath-aware) instead of guessing two exact names. Fixes false ❌ for e.g. actions/cache/restore and azure/cli; private/absent mirrors still correctly ❌.
4. fix: HTML by-workflow action names + readable mixed note — by-workflow rows show the action name again (were @v6); mixed note reads v6 → available instead of → True.
5. feat: expandable action rows — click a row in the HTML inventory to reveal a per-version breakdown (status + hardened target + workflow:line for each version).
6. chore: bump VERSION to 1.3.0 — single version bump for the batch.

Verified against tylerpaxton/cg-actions-test

• Default output is SHA-pinned (…@<sha> # v6.0.3); --pin tag gives tags.
• actions/cache/restore → chainguard-actions/actions-cache (was false ❌); renovatebot/github-action still ❌.
• Per-version resolution intact (checkout @v4 gap vs @v6 available); HTML rows expand to the per-version subtable; by-workflow rows show names.
• All scripts parse; counts reconcile.

🤖 Generated with Claude Code