Upstream vendored-source filtering into the shared TODO scanner

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

Reviewing devantler-tech/ksail#6708 ("fix(ci): ignore vendored TODO comments"), the maintainer
commented:

Consider upstreaming filtering instead of this. That way we keep the integration pure.

That PR shipped a consumer-side ignore, and KSail's .github/workflows/todos.yaml still carries
it today:

uses: devantler-tech/actions/.github/workflows/scan-for-todo-comments.yaml@<pin> # v13.2.3
with:
  ignore: "^third_party/"

The reply on that PR deferred upstreaming because the then-current v13.2.1 exposed no ignore
input. That constraint no longer holds — the input exists as of the pin above — so the steer is
now actionable, and nothing tracks it.

Audience and problem

Every repository that vendors third-party sources consumes this shared scanner. Each one currently
has to know that vendored code produces false-positive TODO issues, and to write its own regex at
the call site. That is repo-specific knowledge living in the integration rather than in the shared
building block: the scanner files real GitHub issues, so a consumer that has not yet learned this
gets spurious issues filed against vendored code it does not own.

Hypothesis

If the shared scanner skips conventional vendored/third-party paths by default, consumers inherit
correct behaviour without configuring anything, and the call site reduces to uses: plus secrets —
the "pure integration" the steer asks for.

Success signal

• KSail's todos.yaml no longer needs a with.ignore block for vendored sources, and its next
  scanner run files no TODO issue for a path under a vendored directory.
• No currently-consuming repository sees a change in which issues get filed, other than the
  removal of vendored false positives.

Smallest useful change

Give the shared workflow a default ignore covering the conventional vendored roots, keeping the
existing ignore input as an override so present callers keep working unchanged.

Acceptance criteria

• The shared scanner excludes conventional vendored paths with no consumer configuration.
• An explicit ignore input still overrides/extends the default — no silent behaviour change
  for an existing caller that already passes one.
• Contract coverage pins both states: a vendored path is skipped by default, and a
  non-vendored path is still scanned (the negative control — a filter that skips everything
  would otherwise pass a one-sided test).
• KSail's call site drops its with.ignore in a follow-up once this ships.

Size

Small. One workflow's input handling plus its tests, and a one-line follow-up in KSail.

Origin: maintainer steer on devantler-tech/ksail#6708.