docs: cut the repeated bits out of the README and action.yml

[lens0021]

A fresh read of the README turned up three explanations of the REST API quota, two lists of the
range syntax, and a paragraph of supply-chain reasoning sitting in the middle of the usage section.

• The pin-by-SHA rationale becomes a two-line > [!NOTE] under the example. It is background for
  someone deciding how to reference the action, not part of using it.
• token in the inputs table said "and nothing else"; it now just says what it authenticates. Same
  in action.yml, which opened with "Used for one thing:" and closed by explaining what does not
  need a token.
• The quota explanation lived in three places. ## Why this exists keeps it, and the sentence about
  latest and git ls-remote joins it there instead of restating the 1,000/hour budget.
• The range syntax was listed once in the detection paragraph and again 40 lines later. One list
  now, keeping the note that != and hyphen ranges are not read.
• The outputs table sat under ## Inputs; it gets its own heading, and the prose after it moves
  under ## Version and checksum.
• Two comments in action.yml both explained why the checksum is in the cache path and key. Merged,
  keeping the separate point about the 2 generation marker.

No behaviour changes — README.md and comments only, apart from the token input description.

Local: yamllint, rumdl, shellcheck and test/version-test.sh all pass.

---

Generated by Claude Code