feat: expose maintenance checks in GitHub Action input

[rksharma-owg]

Summary

Add a first-class GitHub Action input for maintenance checks:

• Adds check-maintenance input to action.yml with default false.
• Resolves input into shell environment and passes --check-maintenance to the scan command.
• Updates GitHub Action docs in website/docs/github-action.md.
• Adds a regression test (tests/github-action.test.ts) asserting the input is present and wired.

Validation

npm test -- tests/github-action.test.ts currently fails before this change due an existing TypeScript type issue in global build fixtures (src/utils/network.ts missing preconnect on injected fetch type).

[sonukapoor]

Really nice @rksharma-owg - the check-maintenance Action input is wired exactly right: it mirrors the check-overrides pattern, is properly gated (only appended when true), does not conflict with offline mode, updates github-action.md, and even adds the first-ever test for action.yml. That part is ready.

One thing to fix before it can merge: the PR bundles an unrelated commit (9e07d6b) that adds overrides: { "brace-expansion": "5.0.8" } to package.json plus jest/ts-jest bumps. That advisory (GHSA-mh99-v99m-4gvg) is already resolved on main - we handled it via the ratcheting baseline in #897, which is our documented preference over a package.json override for a transitive dev-only finding. Could you drop that commit and rebase so this PR is just the Action-input change? Once it is off, this is good to go. Thanks!

[rksharma-owg]

Thanks for the review. I removed the dependency/override commit and rebased the Action change onto current main. The PR now contains only action.yml, its focused contract test, and the GitHub Action documentation update.

Validation:

• tests/github-action.test.ts — 1/1 passed
• git diff --check — passed

The local full build still encounters the unrelated typeof fetch/preconnect error tracked in #885 and #886. CI is running on commit 9b3acb4.