setup-runner: survive a Restricted PowerShell ExecutionPolicy

floating major: v1.4.1

feat(s3-sync): allow local dest paths for download (#39)

A dest starting with ./ or / is a local directory. Needed so assemble
jobs can pull a staging prefix without GitHub artifacts.

feat: add s3-sync (#38)

* feat: add r2-sync for local or R2-to-R2 copy

Small composite for job-to-job R2 (stage then publish) instead of
GitHub Actions artifacts. rclone must already be on PATH.

The existing rclone action's copy operation is a cache, not rclone copy.

* refactor: rename r2-sync to s3-sync

Same composite, S3 API. R2, AWS, and Ceph RGW differ only by endpoint
and provider.

v1.4.1 — pin jdx/mise-action in setup-mise

Pin mise-action to v4.2.0. Forward install_args and reshim so consumers
do not call jdx/mise-action directly.

v1.4.0 — setup-runner, Node 24 google actions

Add setup-runner for C/C++ tool PATH on hosted and self-hosted machines.
Move setup-gcloud and get-secretmanager-secrets to their Node 24 majors.

v1.3.1 — fix nested composite paths for remote consumers

Relative uses: ./setup-mise resolved against the consumer workspace.
Use zondax/actions/setup-mise@v1 and gcp-wif-auth@v1 instead.

Fixes setup-node-env (and sign/react-doctor) after v1.3.0.

v1.3.0 — actions hardening train (#23–#29)

- setup-mise: canonical mise bootstrap (jdx/mise-action@v4)
- setup-node-env: single PM, Node 24 default, no dead cache API
- gcp-wif-auth: single auth step
- checkout-with-app: actions/checkout@v7
- sign-*: dual snake/kebab inputs, shared mise/WIF
- react-doctor: new CLI-owned composite
- docs: MIGRATION.md for consumers

See MIGRATION.md for consumer upgrade notes.

feat: GCP-KMS code-signing composite actions (#12)

* feat(gcp-wif-auth): add token_format + create_credentials_file passthrough

* feat(sign-linux-binary): KMS OpenPGP detached signature

* feat(sign-windows-binary): native-runner Authenticode via jsign + GCP KMS

* feat(sign-macos-binary): rcodesign signing + notarization (RUNNER_TEMP, shred)

* docs: document code-signing actions + gcp-wif-auth token_format

Add a "Code-signing actions" section covering sign-linux-binary,
sign-windows-binary, and sign-macos-binary (runner, inputs table,
outputs, prerequisites), and a gcp-wif-auth updates note for the
new token_format and create_credentials_file inputs.

* feat(signing): macOS fetches Apple creds from GCP Secret Manager; Windows signs on Linux

- sign-macos-binary: drop Apple GitHub-secret inputs; fetch the Developer ID
  .p12/password + notary .p8/issuer/key-id keyless from GCP Secret Manager via
  WIF (auth@v2 + get-secretmanager-secrets@v2), reusing the CODESIGN_* identity.
  Mirrors kunobi-frontend's fetch-apple-signing-secrets migration.
- sign-windows-binary: Windows now cross-builds on the Linux runner (cargo-xwin),
  so jsign runs there; install a headless JRE via apt if missing (was: assume
  native Windows runner with JRE on PATH).
- README: update both sections.

* fix(sign-linux-binary): resolve gpg (not gpg2) for fingerprint extraction

Modern Debian/Ubuntu (incl. kunobi-runners) ship GnuPG 2.x as 'gpg', not
'gpg2'. Resolve gpg||gpg2 and apt-install gnupg if neither — the cert step
was failing with 'gpg2: command not found' (exit 127).

* fix(signing): provide JRE via setup-java; use sudo for apt fallbacks

The Windows signer cross-builds on the Linux runner and needs a JRE, but
apt-get fails on hosted runners (the composite action runs unprivileged;
only passwordless sudo works), so 'java: command not found' (exit 127).
Use actions/setup-java (cached on the image, no root) instead of apt.
Apply the same reasoning to the Linux signer's gpg fallback: route its
(rarely-hit) apt install through sudo.

fix(setup-node-env): use github backend for pnpm (#11)

Mise's default `pnpm` resolves through aqua:pnpm/pnpm, whose registry
expects `pnpm-<os>-<arch>.tar.gz` assets. pnpm v10 ships raw binaries
on Linux (`pnpm-linux-x64`, no extension), so `mise use --global pnpm@10`
followed by `mise install` fails with "no asset found:
pnpm-linux-x64.tar.gz" on every Linux caller.

Switch to the `github:` backend explicitly. It downloads the actual
release asset, handles raw binaries, and is the supported successor
to `ubi:`. Backward compatible at the action interface — `pnpm_version`
input still accepts the same values.

Tested locally: `mise use --global "github:pnpm/pnpm@10"` resolves to
10.33.3, downloads the platform-correct asset, and the resulting
`pnpm` shim is on PATH identical to the previous aqua-backed setup.