Composite action with curl install + npm fallback, SARIF upload, artifact upload, and 28 configurable inputs mapping to cpd CLI flags.