Provide a reusable action for pinned release-tool PHAR execution

[vitormattos]

Parent: #70
Depends on: #82
Blocks: #71, #76

Goal

Provide one reusable GitHub Action adapter for downloading, verifying and invoking an exact released LibreCodeCoop/release-tool PHAR.

No later workflow should implement its own PHAR download/checksum logic.

Inputs

At minimum:

• exact release-tool version;
• expected artifact/checksum source defined by the release-tool release contract;
• optional command/arguments where appropriate.

Do not accept latest, floating branches or unverified arbitrary URLs.

Behavior

The action:

1. resolves the exact release-tool release artifact;
2. downloads release-tool.phar and its SHA-256;
3. verifies the checksum before execution;
4. exposes the verified PHAR path;
5. reports the exact tool version in the step summary/log;
6. optionally invokes a requested read-only command or leaves execution to the caller, whichever produces the cleaner reusable contract.

Keep the Action thin: no release policy belongs here.

Security

• pin all third-party Actions by immutable SHA;
• use least-privilege permissions;
• do not echo tokens;
• fail closed on checksum mismatch;
• do not execute an unverified artifact;
• actionlint and zizmor must pass.

Output artifact

This issue produces the stable reusable action contract consumed by #71 and later orchestration.

Expected conceptual usage:

- uses: LibreCodeCoop/github-workflows/actions/setup-release-tool@<pinned-sha>
  with:
    version: v0.x.y

The exact public action name/path may change during implementation, but there must be exactly one supported PHAR setup/verification path.

Tests

Cover:

• valid exact version/checksum;
• checksum mismatch;
• missing artifact;
• unsupported/floating version input;
• PHAR --version after setup.

Acceptance criteria

• one reusable PHAR setup contract exists;
• no release business logic is embedded;
• checksum verification is mandatory;
• Plan and validate a selected release with the reusable engine #71 can execute the same PHP CLI in Actions that maintainers run locally;
• later workflows reuse this action rather than copy setup shell code.

Definition of done

• one reusable setup action exists in github-workflows;
• it accepts only exact supported release-tool versions and verifies SHA-256 before execution;
• valid, checksum-mismatch, missing-artifact and floating-version cases are tested;
• actionlint/zizmor and pinned-action checks pass;
• Plan and validate a selected release with the reusable engine #71 and later workflows use this action instead of custom PHAR download logic.

[vitormattos]

Implemented and validated in #91 and #92. The setup action accepts only exact release-tool versions, verifies the published SHA-256 before execution, fails closed for checksum mismatch and missing artifacts, rejects floating/range versions, and passed a real smoke test against release-tool v0.1.0. actionlint, zizmor, workflow policy, REUSE and Python tests are green.