docs(plans): GitHub Marketplace Action plan + LSP repo-structure update (#73)

* docs(plans): GitHub Marketplace Action plan + LSP repo-structure update

New plan `docs/plans/github-marketplace-action.md` for a composite
`stainless-code/codemap@v1` Marketplace Action. Resolves all 10 open Qs
from a grilling pass (Q-A premise → Q10 Marketplace metadata):

- Q-A scope: ship full v1.0 (5 slices including PR-comment writer for
  GHAS-less private repos + bot-context seeding); inline-review comments
  deferred to v1.x with concrete demand trigger.
- Q-B publishing: same-repo (`stainless-code/codemap`); split-repo's
  drift risk between `action.yml` and CLI flags is asymmetric.
- Q5 default: `audit --base ${{ github.base_ref }} --ci` on
  `pull_request` events; no-op + log on other events.
- Q1 input surface: ship the ideal day-one (~16 declarative inputs,
  `mode` + structured); `command:` is the universal escape hatch.
- Q2 + Q3: delegate to `package-manager-detector` (antfu/userquin) +
  `resolveCommand`'s `'execute-local'` / `'execute'` intents.
- Q7: floating major `@v1` + changesets-driven release; Action version
  stream is independent of CLI version stream (CLI at 0.4.0).
- Q4 PR-comment: (b) summary in v1.0 (opt-in); (c) inline reviews
  deferred. Closes the SARIF-vs-conversation surfaces gap (private repos
  without GHAS, aggregate audit deltas, bot-context seeding).
- Q6 ripple: `mode: aggregate` shipping day-one promotes multi-recipe
  SARIF rule.id de-dup to a v1.0 blocker.

Two genuine new CLI surfaces ship alongside the Action (caught by
fact-check 2026-05): `audit --format sarif` (today only emits `--json`)
and the `--ci` aggregate flag on `query` + `audit`. Sliced as 1a/1b.

LSP plan (`docs/plans/lsp-diagnostic-push.md`) updates:

- Repo-structure tradeoffs: third surface added — docs site (Fumadocs +
  `@fumadocs/local-md`, or Fumapress). Verified against cloned
  fuma-nama/fumadocs HEAD: multi-framework (Next.js / Astro /
  Tanstack Start / Waku / React Router); markdown-only site does NOT
  trigger monorepo conversion.
- Trigger #5 added: docs site needs to import codemap source (live
  recipe runner / WASM demo / interactive schema explorer).
- Q4 stale-claim fixed: `boundary-violations` parenthetical "(assuming
  § 1.5 ships first)" removed — boundary-violations shipped PR #72.

Roadmap backlog: new "GitHub Marketplace Action" entry; existing
audit-verdict entry annotated with "Action shipping is the most likely
accelerant for the verdict-trigger fire".

No code changes; plan-only PR. Implementation lands in subsequent PRs.

* docs(plans): address PR #73 review — fix deprecated set-output + MD040

CodeRabbit fact-checked both findings against current code; both real.

- T1 (Major): replaced deprecated `::set-output` (deprecated 2022-10 per
  GitHub changelog) with the `GITHUB_OUTPUT` environment file approach
  in the package-manager-detector wrapper sketch (Q2 resolution). Used
  `appendFileSync(process.env.GITHUB_OUTPUT, ...)` per current GitHub
  Actions docs.
- T2 (Minor, MD040): added `text` language tag to the Q3 resolution
  pseudo-code block so markdownlint-cli2 stops flagging the unlanguaged
  fence.

* docs(plans): clarify query/audit asymmetry + Q5 target-state qualifier

CodeRabbit's deeper fact-check (via GitHub API after sandbox clone failed
twice) confirmed all earlier claims accurate, but flagged two clarity
gaps in the new-CLI-surfaces framing:

- L.6 didn't surface that `--ci` is asymmetric across verbs: on `query`
  it's a new alias for already-shipped `--format sarif` (PR #43); on
  `audit`, both `--format sarif` and `--ci` are net-new. Added an
  explicit "Asymmetry worth surfacing:" line with the per-verb breakdown.
- Q5's resolution presented `audit --base ... --ci` as the default
  Action command without a temporal qualifier — consumers reading just
  Q5 would assume it's runnable today. Added "Note: this command is the
  target state — both flags ship in Slice 1 alongside the Action; the
  default isn't runnable on the current CLI."

Both clarifications also help future PR reviewers spot whether
implementation slices match the documented surface set.

Author: SutuSebastian