bump scanner to SDK 0.6.x

[chiruu12]

The action defaulted to unplug-ai>=0.4.0,<0.5. The scanner fixes from
UnplugAI/Unplug#51 shipped in 0.6.0 on July 20, so every consumer has been
running the pre-fix scanner since then.

What 0.4.x misses, reproduced locally on the same repo state:

case	0.4.1	0.6.0
injection in .github/agents/helper.md	exit 0, "no issues found"	exit 1, flagged
missing base ref	CalledProcessError traceback, exit 1	::error::, exit 2

Injections straddling a 2000-char chunk boundary are also missed on 0.4.x;
0.6.0 uses a 200-char sliding overlap.

Bumps the default, the CI install, and the README to >=0.6.0,<0.7.

The existing CI fixtures use .cursor/mcp.json, which 0.4.x detects fine, so
they passed the whole time. Added three cases that pin the floor to actual
behaviour:

• injection under .github/agents/ is flagged (fails on 0.4.1)
• .github/workflows/*.yml stays out of scope
• missing base ref exits 2

The action-level preflight from #5 already covers the missing-base-ref case at
the wrapper. The chunking and .github/ gaps only exist in the SDK, so the pin
was the only thing keeping them open.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[greptile-apps]

Greptile Summary

The PR raises the default Unplug scanner dependency from the 0.4.x series to 0.6.x so consumers receive the newer scanner behavior.

• Updates the action default, CI installation constraint, and documented installation commands to unplug-ai>=0.6.0,<0.7.
• Adds CI coverage for scanning agent files under .github/agents/.
• Verifies that workflow files remain excluded and missing base refs produce the expected SDK error exit.

Confidence Score: 5/5

The PR appears safe to merge, with the dependency bump consistently applied and its intended scanner behavior covered by CI.

The action, documentation, and CI use the same 0.6.x constraint, and the added fixtures exercise the behavior motivating the upgrade without exposing a concrete blocking failure.

Important Files Changed

Filename	Overview
action.yml	Raises the default scanner constraint to the 0.6.x series while preserving the existing installation and invocation flow.
.github/workflows/ci.yml	Installs the new scanner range and adds focused fixtures for .github path filtering and missing-base-ref handling.
README.md	Keeps the documented action default and local installation command aligned with the new scanner range.

_{Reviews (1): Last reviewed commit: "bump scanner to SDK 0.6.x + regression t..." | Re-trigger Greptile}