Document the beta release and Action rollback flow

[daichunghy]

PatchGate has a bundled Action candidate but no public beta release yet. We need a concise release and rollback guide before asking external repositories to install it.

The guide should cover:

• how to validate a clean release commit
• immutable Action tags versus moving major tags
• Marketplace publication prerequisites
• consumer installation by full commit SHA
• upgrade, downgrade and rollback steps
• what the Action does not claim, including App identity, code correctness and tamper-proof receipts

Acceptance:

• a maintainer can follow the guide from a clean checkout
• the guide names the required permissions and safe shadow defaults
• rollback is tested or clearly marked as pending evidence

See docs/github-action-usage.md, docs/implementation-roadmap.md G6 and the project constitution.

Start here

1. Read the Action usage guide and the G6 section of the roadmap.
2. Run npm run verify:dist from a clean checkout.
3. Write one tested install path and one tested rollback path. Mark anything that still needs external evidence as pending.

[daichunghy]

Maintainer note: a useful first contribution here does not need to wait for Marketplace publication. A strong starting point is a clean-checkout smoke path that documents the required permissions, pins the Action by full commit SHA, and shows an explicit rollback to the previous known-good SHA. Please mark each step as locally tested or still pending evidence; the guide should not imply release readiness that has not been verified. If you want to take this on, comment with the documentation section or test path you would start from.