Ladon versioning: inherited-logic hardening + composite versioned-ref switch

[andybevan-scope3]

Follow-ups from the code review of #3 (per-action version tagging). The quick, self-contained fixes (paths-ignore **/*.md, checkout pin, dead majorVersion input) landed in #3 (4d2d191). This issue tracks the items that either fork vendored logic or depend on tags existing first.

Correctness (priority): switch the orchestrator to versioned refs

ladon/review/action.yml nests siblings via local ./ladon/setup|reviewer|arbiter. Per-action tags advance independently, so ladon/review/v1 pins its children to review's last-changed commit: a fix to ladon/setup advances ladon/setup/v1 but not ladon/review/v1, and a consumer of @ladon/review/v1 keeps running the pre-fix setup. This is a correctness requirement, not cleanup.

Do this only after the initial ladon/*/v1 tags exist (merge #3 → run manual-version-publish with runForAll: true):

• switch the three nested uses: in ladon/review/action.yml to adcontextprotocol/actions/ladon/<action>@ladon/<action>/v1.

Inherited from the scope3 versioning source (fixing = diverging from the vendored action; consider upstreaming)

• TS-action major derivation is inconsistent/inert. First tag is hardcoded 1.0.0, and the bump compare uses the full package.json semver. With setup/arbiter at 0.1.0, the declared version never drives the tag; a later 0.1.0 → 1.0.0 bump patch-bumps instead of cutting v2, while a → 1.1.0 bump would spuriously cut v2. Composite actions (normalized to major.0.0) don't have this. Result: no discoverable, consistent way to cut a TS-action major.
• compareCommits isn't paginated (300-file cap). A large merge (mass reformat / lockfile churn) can leave a changed action undetected and untagged. Fix: octokit.paginate, or derive changed paths from git diff --name-only <before> <after> on the checked-out repo.
• A composite action added without version.yml is silently skipped (warning only, no tag). Consumers pinning its @v1 resolve to nothing. Consider failing loudly, or defaulting composites to version: 1.
• Uncapped Promise.all over tag mutations can trip GitHub's secondary rate limit on a runForAll across many actions. Fine at 4; cap concurrency as the action count grows.

Ops / verify

• Confirm main is (and stays) the integration branch — merge-publish triggers on push to main, but the repo's configured default branch is placeholder-readme-pr. Merges landing off main would silently skip tagging.
• Initial tagging isn't automatic: after feat(release): per-action version tagging for Ladon actions #3 merges, setup/arbiter get no v1 until someone runs manual-version-publish with runForAll: true (do dryRun: true first).
• One line in internal/versioning/index.ts (~L451) exceeds the 80-col Biome limit; nothing enforces Biome in CI/pre-commit yet, so it's a latent convention gap.

🤖 Generated with Claude Code