feat: harden GitHub Action execution

[brandonwise]

Summary

• harden the composite GitHub Action by moving install/scan logic into tested Bash scripts that use arrays instead of string-concatenated args
• add install-mode: source so the action can build the checked-out repo for PR/self-test workflows
• add an action-smoke CI job plus a local smoke test that proves paths and output files with spaces work end to end
• document the composite action path and the new source install mode in the README

Why

The old action built a single shell string (agentwise $ARGS), which breaks on paths with spaces and is a bad pattern in a security-focused repo. This change makes the action safer, reproducible, and self-testable before release.

Validation

• cargo fmt --all -- --check — PASS
• cargo clippy --all-targets -- -D warnings — PASS
• cargo test --all-targets — PASS (217 unit + 38 integration)
• cargo build --release — PASS
• bash tests/action_smoke.sh — PASS
• bash -n scripts/action-install.sh scripts/action-scan.sh tests/action_smoke.sh — PASS
• node /Users/bwise/.openclaw/workspace/projects/humanizer/src/cli.js score README.md — PASS (36/100)