feat(action): command-mode inputs + built-in matrix names

[ErenAri]

Wires the command/binary validation mode into the composite GitHub Action, so a project can gate CI on its own loader in one step — the capability Falco's and vimto's maintainers both asked for, now first-class in the Action:

- uses: Kernel-Guard/bpfcompat@v0.2.0
  with:
    command: $BPFCOMPAT_BIN --self-test
    command-binary: build/myloader
    matrix: quirk-library       # built-in name -> matrices/ shipped with the action
    out: reports/bpfcompat.json

Changes

• New inputs command, command-binary, command-expect-exit; artifact becomes optional when command is set (mirrors the CLI contract).
• Injection-safe: free-text inputs are passed through the step environment, never inline ${{ }} interpolation, so a hostile command string cannot inject host-side shell syntax.
• Built-in matrix names: a bare matrix value that doesn't exist in the caller repo resolves to the matching matrices/<name>.yaml shipped with the action — quirk-library works with no file to copy.
• README: command-mode Action example; fixed the stale marketplace step that still claimed a self-hosted KVM runner is required (hosted ubuntu-latest exposes /dev/kvm).
• docs/command-validation.md: GitHub Action section.

Verification

Extracted the composite run script and exercised every branch against a fake binary:

• command mode + built-in quirk-library → resolves to the action's matrices/, forwards --command/--command-binary, omits --artifact ✅
• plain artifact mode → unchanged ✅
• command-binary without command → ::error ✅
• hostile command string ("; touch PWNED; echo ") → stays one argv, file never created ✅
• command-expect-exit: 2 → forwarded ✅

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.