chore(marketplace): prod-readiness for Marketplace listing (author, launch vocab, SHA-pin, alternate install)

[jadoonf]

Summary

Marketplace prod-readiness pass ahead of the launch. Additive doc/manifest changes only — no src/, no dist/, no behavior change.

• action.yaml: renamed name to the launch vocabulary Garnet Runtime Review (was "Garnet Runtime Visibility"), added the required author field, and sharpened description. Branding (icon: activity, color: purple) was already valid and is unchanged — Marketplace branding requirement is satisfied.
• README.md:
  • Title + tagline updated to "Garnet Runtime Review" launch vocabulary.
  • Quickstart now includes a SHA-pinned example (@189e3fe… = v2.1.0) alongside the @v2 floating-tag example, called out as recommended for production.
  • New "Not using GitHub Actions?" section giving CI-less users an alternate path: GitHub App, garnetctl CLI + Jibril agent (any CI/host), and Docker/Kubernetes — so non-Actions users aren't dead-ended. CLI snippet matches the real garnetctl config set-baseurl/set-token commands used by the action.

What was already in good shape and left as-is: MIT LICENSE, SECURITY.md, inputs/outputs tables, permissions block, docs links, and the v2 → v2.1.0 semver + floating-major tags.

Verification: npm run typecheck and npm run build pass; dist/ is unchanged (in sync); markdownlint clean.

Not in this PR (flagged for owner): the PR-comment header renders "Garnet Runtime Report" — left untouched to avoid conflicting with in-flight narrative-comment work; and clicking Publish on Marketplace requires a garnet-org org owner + screenshots.

Link to Devin session: https://app.devin.ai/sessions/72e1bbc51dab40ee9a5aa25889a72d6d
Requested by: @jadoonf

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[jadoonf]

Rebased onto current main (2f84b93) and force-pushed with lease — conflicts in action.yaml and README.md resolved; the PR is no longer CONFLICTING.

Resolution notes:

• action.yaml: kept main's launch-vocab name/description (main had already adopted "Garnet Runtime Review"), added this PR's author: "Garnet Labs Inc.". Trimmed the description to 120 chars (was 137 on main) so it clears the Marketplace ≤125-char limit (ENG-1335).
• README: kept main's launch copy (title/tagline), kept this PR's SHA-pin example and "Not using GitHub Actions?" alternate-install section, and refreshed the stale SHA pin from 189e3fe (v2.1.0) to 3d47f4a (v2.2.0, the latest release on main).

Sequencing (ENG-1356): keep as draft until the v6.1 renderer port (#99) merges and v2.3.0 is cut — then bump the README SHA-pin example to the v2.3.0 commit and update Marketplace screenshots to the v6.1-shape comment before un-drafting.

[garnet-runtime-review]

Execution Profiles recorded for 1 job, triggered by 76fd457

6 execution chains · 6 destinations · no change since fd0da9f · recorded at the kernel by Garnet · 2026-08-06 23:11:59 UTC

CI / build-and-verify ↗ · Install dependencies reached 1 destination · no change

Runner.Worker
├─ node
│  └─ → api.github[.]com
└─ bash
   └─ node
      └─ → registry.npmjs[.]org

_{dns + runner substrate · 4 chains}

@@ 76fd457 vs fd0da9f @@
  systemd
  ├─ python3.12
  │  └─ python3.12
+ │     └─ → 168.63.129.16
  ├─ hosted-compute-agent
  │  └─ sudo
  │     └─ provjobd
+ │        └─ → glb-p4a577-public-internal.githubapp[.]com
  └─ systemd-networkd
+    └─ → ip6-allrouters
  Runner.Worker
  └─ bash
     └─ node
        └─ → localhost (dns resolver)

_{View this job's Execution Profile in Garnet →}

---

_{💡 How to read this}

Runner.Worker                ← the runner: root of the job's execution tree (italic)
└─ npm install               ← a process your job ran (bold)
   └─ → registry.npmjs[.]org  ← an action: what the process did — an outbound connection, defanged
      ╰ one chain of processes, root to action: an execution chain

_{The tree is every chain the job ran; a process appears only when it acted.}

_{+ new destination · − destination no longer reached, vs the previous profiled commit.}