docs: document immutable release model and correct branch reference

[MaddyMicrosoft]

Summary

Documents the immutable release model for consumers and fixes a misleading reference in the README.

Changes

• New "Release integrity" section — explains that published releases are immutable: exact version tags are frozen (never moved/deleted), the built lib/ lives on release tags/branches (not master), and v3 is the one intentionally-floating pointer that only ever advances to published release commits. Recommends SHA-pinning for supply-chain hardening.
• Fixed the "Branch reference" section — uses: azure/login@master was documented as usable, but master contains source only (lib/ is gitignored and built only onto release refs), so it would fail to run. Replaced with a warning pointing to tags/SHA.
• Added the new section to the table of contents.

Notes

• Consumer-facing only; no code or workflow changes.
• markdownlint passes (0 issues); anchor links verified.

[Copilot]

🟡 Changes recommended

The “Branch reference” section still presents a copy/pasteable @master example, which undermines the goal of steering consumers away from branch refs.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates consumer-facing documentation in README.md to describe the repository’s immutable release model and to clarify that branch refs (like the default branch) are not supported for action consumption because built artifacts are published only on release refs.

Changes:

• Added a new Release integrity section describing immutable exact-version tags and the intentionally floating major tag (v3).
• Replaced the prior “branch reference” guidance with a warning that @master (and other branch refs) are not runnable because lib/ isn’t present there.
• Updated the table of contents to include the new section.

File summaries

File	Description
README.md	Adds “Release integrity” documentation and corrects branch-ref consumption guidance to point users to tags/SHA.

Review details

Suppressed comments (1)

README.md:112

• After changing the code-block example away from @master, the warning text should also be updated so it doesn’t imply only @master is the problematic case; any branch ref (including the default branch) is non-consumable because lib/ isn’t present there.

> Branch references such as `@master` are **not** supported for consumption. The action's compiled output (`lib/`) is not committed to `master`; it is built and published only to release tags and `releases/*` branches, so referencing `@master` will fail to run. Use a major-version tag, an exact version tag, or a full-length commit SHA instead.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.