fix(actions): resolve capture core from action checkout

[noah-ing]

What

Resolve the bundled agentrust-capture-core package from the composite action checkout for the Cursor, Copilot, Gemini CLI, and Windsurf actions, and add a regression test to the validation workflow.

Why

For a remote action such as uses: agentrust-io/integrations/cursor@<ref>, GITHUB_WORKSPACE points to the caller's repository, not the checkout containing the action. The current install command therefore looks for packages/agentrust-capture-core in the consumer repository and fails unless that unrelated path happens to exist.

${{ github.action_path }} identifies the checked-out action directory. Resolving ../packages/agentrust-capture-core from there keeps the package and action on the same referenced revision and avoids crossing into caller-controlled workspace content.

The new regression creates separate action and consumer checkout trees, places a decoy package path in the consumer tree, and verifies all four actions resolve only the bundled package from the action checkout.

Test plan

• python -m pytest tests -q — 28 passed
• Cursor, Copilot, Gemini CLI, and Windsurf engine suites — 100 passed total
• python scripts/validate_integrations.py — 35 integrations, 0 failures
• python scripts/validate_compatibility.py — 0 failures
• marketplace and AGT catalog generation checks — current
• repository Ruff command — passed
• nox — all 14 isolated sessions passed
• detect-secrets 1.5.0 on changed files — 0 findings
• git diff --check and git fsck --full — passed

DCO

The commit is signed off under the Developer Certificate of Origin.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.