ci: bring repo up to podium/kubernetes-toolkit/debug-toolkit standard

[swade1987]

(This post authored by my AgenC)

Summary

Real bugs found and fixed, verified by actually building and running the image, not just reading the Dockerfile:

• commit-lint.yaml and pr-lint.yml both used pull_request_target - the dangerous-workflow pattern already fixed on podium and kubernetes-toolkit.
• kustdiff used the deprecated ::set-output:: workflow command. Checked rather than assumed: GitHub postponed removing it indefinitely, so it's not currently broken, but it produces a deprecation warning on every run. Modernized to $GITHUB_OUTPUT's heredoc form - and removed the manual %0A newline-escaping that went with the old mechanism, since the new one takes raw multiline text directly; keeping both would have shown literal %0A in every PR comment instead of real line breaks.
• The README's own recommended usage example requested contents: write, but kustdiff never pushes anything (confirmed by reading the whole script) - downgraded to contents: read, matching what kustomize-diff-test's own real workflow already uses. Also fixed a misleading line of prose claiming the action "commits changes back to your PR" - it posts a comment, nothing is ever committed.
• Removed a dead unused variable (safe_base_ref) in kustdiff.
• Added a real build/e2e test (test.yml) - there was previously zero automated verification that the Docker image builds or that kustdiff actually works. It builds the image, clones kustomize-diff-test (the existing fixture repo), makes a deterministic change on a throwaway local branch, runs the action against it, and asserts the diff output is actually correct - not just that the command exited zero.
• Dropped the helmv3 binary/symlink alias (same fix as debug-toolkit) - nothing in this repo referenced it, and it's about to become actively misleading now that Helm tracks flux's version, which is currently v4.

Also added, matching the established bar on the sibling repos: hadolint + shellcheck, Scorecard, Dependabot, SECURITY.md, CODEOWNERS, pinned/refreshed action SHAs, digest-pinned base image.

New: scripts/upgrade-flux-versions.sh + weekly monitor-flux-versions.yml, keeping kustomize/Helm in step with what flux itself is built against (same derivation as kubernetes-toolkit: flux2's release -> Components changelog -> kustomize-controller/helm-controller go.mod). Uses the signed-commit mechanism (scripts/lib/signed-pr.sh, GitHub's createCommitOnBranch API) from the start, since I already know local git commit in CI produces unsigned commits that fail this repo's required_signatures rule and DCO check - no need to rediscover either bug here.

Test plan

• Built the actual Dockerfile and ran the real image (not just --version) against kustomize-diff-test's real fixtures, both the plain-kustomize path and the --enable-helm path (a real Helm chart pull), before and after every change
• Verified the modernized $GITHUB_OUTPUT mechanism produces correct, readable multiline output (real newlines, no %0A) for both the diff and no-diff cases
• Verified the E2E test's own pass/fail assertions actually discriminate - tested them against known-good, empty, and wrong-content inputs, not just the happy path
• scripts/upgrade-flux-versions.sh dry-run against the real flux2/kustomize-controller/helm-controller APIs - correctly reports kustomize already in sync (5.8.1) and Helm needing a bump (3.19.2 -> 4.2.4, correctly flagged as a major-version crossing)
• hadolint/shellcheck --severity=error clean; all workflow YAML parses

[swade1987]

🎉 This PR is included in version 0.6.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀