fix(action): make CI reports deterministic

[aidenybai]

Why

React Doctor's CI surfaces had three concrete reliability failures:

• the scheduled Delta Audit compared the current CLI with an obsolete 0.7.9 baseline and failed every night
• the GitHub Action streamed JSON through stdout redirection, matching the truncated/invalid report failures in Scan intermittently exits 0 but writes no valid JSON report (stdout truncation race, not diff-content-dependent) #1242, React Doctor Action failed #1258, and React Doctor Action failed #1331
• the Action compared the PR base with the synthetic merge-ref HEAD, so base-branch drift could be reported as PR-authored changes (v2 changed-file discovery includes base-branch drift from PR merge checkout #1446)

The user job is for CI to produce a complete report scoped to the pull request. Success is the disappearance of the invalid-report signature plus parity between local and API changed-file discovery. Roll this back if either signal regresses.

What changed

• write Action reports through the existing --json-out path
• diff the pull request event's base SHA against its head SHA
• execute the real Action base step in a merge-ref regression fixture
• refresh the pinned eight-repository Delta Audit baseline for CLI 0.9.12
• remove an unused Node path import surfaced by CI

This does not add or change Action inputs, outputs, telemetry, or npm package APIs. It carries forward the focused base/head correction from #1447 without that draft's broader test rewrite.

Validation

• nr test — 12/12 tasks; 2,493 React Doctor tests passed, 24 skipped
• nr lint
• nr typecheck
• nr format:check
• nr smoke:json-report
• deterministic Delta Audit comparison — 171 unchanged rules, zero alerts
• Action release guard — recommends patch v2.2.8 → v2.2.9

No npm changeset is needed because the GitHub Action is versioned independently. After review and merge, releasing v2.2.9 and moving v2 require separate explicit approval; this PR does not create or move tags.

[github-actions]

📦 GitHub Action release recommended

This PR changes the React Doctor GitHub Action's release surface:

• action.yml

The composite action is versioned independently from the npm packages, so it
needs its own git tag once this merges. Based on the PR title, this looks like
a patch bump (fix / refactor / chore / docs): v2.2.8 → v2.2.9.

After merging, cut the tag from the merge commit on main (tags are GPG-signed
annotated tags, so run this locally where your signing key is configured):

git checkout main && git pull --ff-only
merge_commit=$(git rev-parse HEAD)
git tag -a v2.2.9 "$merge_commit" -m "react-doctor action v2.2.9"
git tag -fa v2 "$merge_commit" -m "react-doctor action v2 (floating major -> v2.2.9)"
git push origin v2.2.9
git push --force origin v2   # moves only the floating major pointer

_{This bump can also be performed automatically on merge — set the repo
variable AUTO_BUMP_ACTION_TAG=true. Recommendation by the Action Version Bump workflow.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@1670

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@1670

npm i https://pkg.pr.new/react-doctor@1670

commit: 2bbb72e

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 2bbb72e.}

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at 2bbb72e in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence