[hblee12294]

This action runs with every caller's job token and their vos.so content key, so what it executes must be fixed by the caller's pin, not by what npm or GitHub serve that minute:

• A new cli input, an exact @vosjs/cli version with a default the action's releases move; the install refuses anything that is not a version.
• Every input and every github.* value reaches a shell through env, never spliced into a run script.
• actions/upload-artifact and the CI workflow's actions are pinned to commits; .github/dependabot.yml moves the pins in one grouped PR a week.
• CI's job names what it holds (contents: write for the tracked base it commits back, pull-requests: write for the comment); nothing by default.
• CODEOWNERS on action.yml, scripts/ and .github/.
• The README names the cli input and tells callers to pin the action by commit.

After the merge the v1 tag moves to this commit.

[github-actions]

Release media for ci-15

Not pushed: no VOS_API_KEY was given, so the take stayed in the runner. Add the secret and the next run versions it on your shelf.

Channel	Asset	Size	Bytes	Length
github	readme-loop	1920x1080	2038 KB	11.0 s

Verifier: 0 problems across 1 asset, re-measured from their bytes.

The kit is attached to the run as the artifact release-kit-ci-15. Made by vos: the next release is a re-render of the same actions.json, not a re-shoot.