docs: publish stable root action quickstart

[roli-lpci]

What changed

• Replace supported nested-action and mutable-branch guidance with the root Marketplace action pinned to audited commit 1a70edc12bfd19e633983e0819b648bb2a5dda4e.
• Make the copyable example read-only and blocking with contents: read, repair/comments omitted, and fail-on-error: "true".
• Add an adjacent optional PR-comment example with pull-requests: write and fork-token limitations.
• Document the exact root inputs/outputs, final/raw/repair/dependency statuses, changed-file strategy, hidden .pygate/ artifact behavior, full-mode caller prerequisites, repair mutation, and immutable pinning policy.
• Correct stale SECURITY guidance and add a compact root-action contract to llms.txt.
• Make the example workflow self-checking by installing this repository's declared .[dev] dependencies before the root action, while excluding only the intentional negative tests/action-fixture/fail.py from repository-wide Pyright.

Exact scope

• README.md
• .github/workflows/example-usage.yml
• SECURITY.md
• llms.txt
• pyproject.toml (single intentional-negative-fixture Pyright exclusion)

The legacy nested implementation is untouched. This PR does not create a release tag, change version metadata, or submit Marketplace state.

Checks

• actionlint .github/workflows/example-usage.yml
• Example least-privilege and immutable-pin assertions
• Repository search proving no supported docs recommend nested @main or root mutable @main
• Manifest/documentation input-output field parity against action.yml
• Relative links/anchors validation
• Local Pyright: 0 errors, 0 warnings
• pytest tests/ -q: 158 passed on Python 3.12.13
• git diff --check
• Live quality-gates, lint/typecheck, Python 3.10–3.13, smoke matrix, artifact verification, and contract controls: all passed after the self-check fix

Live boundary

The root action's runtime behavior is exercised by the validated example workflow and live PR checks. The PR is ready for review and is not merged. CodeRabbit review was rate-limited.

[coderabbitai]

Warning

Review limit reached

@roli-lpci, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 1 minute

Limit details: You’ve used all 3 included reviews currently available under your plan.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 15cf1e83-3eaf-4b6f-9b2a-b93c54073dd8

📥 Commits

Reviewing files that changed from the base of the PR and between 1a70edc and d6c78c3.

📒 Files selected for processing (5)

• .github/workflows/example-usage.yml
• README.md
• SECURITY.md
• llms.txt
• pyproject.toml

---

_{Comment @coderabbitai help to get the list of available commands.}