Add a CLI compatibility contract: version guard, canary, matrix

[kristof-siket]

Stacked on #12 (base is fix/current-prisma-cli; retarget to main once #12 merges).

Why

The 8.0.0-rc.8 command rename broke every released action version at once (v1.0.0–v1.5.0, the floating v1, and main), because the action floats against whatever CLI it finds — the repository's prisma devDependency preferred, an unmaintained fallback otherwise — with no compatibility contract. Users found out via CLI.UNKNOWN_COMMAND in their deploy logs.

What

• Version guard (cli.mjs, main.mjs): before deploying with a repository's own prisma devDependency, the action probes prisma --version and fails with an error naming the supported range (>= 8.0.0-rc.8, top-level prisma deploy) when the CLI falls outside it. An unreadable or unparseable version is a warning, never a blocker — the guard must not break a working deploy over output formatting. The bunx fallback is not probed; its version is the release's own pinned default.
• Canary workflow (.github/workflows/canary.yml): daily + on-demand, probes prisma@next for the exact command shape the action invokes. Subtlety verified against the real CLI: --help exits 0 even for unknown commands (falls back to the general help, whose Examples section even contains a bare $ prisma deploy), so the probe greps for the deploy-specific usage line $ prisma deploy [options] rather than trusting exit codes. It also asserts the version guard accepts prisma@next (a guard that rejects the upcoming release would block users the day it ships), and posts a non-failing notice the day a top-level destroy appears so mode: destroy can be wired back up.
• Compatibility matrix in the README, stating the policy and the supported range per release line.

Verified

• 53 tests pass (node --test tests/*.test.mjs), including new coverage for version extraction (JSON envelope, human line, dev-build suffix) and range checks (rc.7 rejected, rc.8/rc.9/stable/later accepted, pre-8 rejected).
• All three canary probes dry-run green locally against prisma@next (currently 8.0.0-rc.9).

🤖 Generated with Claude Code