feat: propagate step uses version inline comment to YAML output (#11)

feat: propagate HCL inline comments on attributes to YAML output (#10)

Introduces an `annotated` wrapper type that threads trailing `#
comments` from HCL attributes through the `map[string]any` pipeline.
`toYAMLNode` unwraps it and attaches the comment as a `LineComment` on
the YAML node, so any attribute-level comment in HCL appears inline in
the generated YAML.

Validators that type-assert map values use `unwrapAnnotatedMap` to strip
the wrapper before checking. The permissions-specific
`parsePermissionsBlock` and `permissionsMapNode` helpers are removed —
the general mechanism covers that case automatically.

fix(parse): always emit permissions: {} in workflow YAML output (#9)

When no permissions block is present in HCL, the workflow now emits
permissions: {} (deny all) rather than omitting the key. An empty
permissions {} block already emitted {} after the previous fix, but the
global ": {}\n" → ":\n" post-processor in marshalWorkflowYAML was
silently erasing it. Fixed with a sentinel-swap that protects
permissions: {} through the strip.

All 14 affected golden fixtures updated. Explicit unit tests added
(TestParsePermissionsDefault) covering: no block, empty block, and
scoped permissions.

fix: version comment and permissions (#8)

fix: preserve HCL-defined job order in parse direction YAML output (#7)

fix: preserve job order during YAML→HCL unparse using yaml.v3 Node API (

#6)

fix: preserve emoji ZWJ sequences through YAML↔HCL roundtrip (#5)

feat: add --yml flag to generate .yml workflow files instead of .yaml (…

…#4)

feat: AI assist command and github pin and upgrade subcommands (#3)

feat: auto-release on push to main