Pin @action-validator/core and @action-validator/cli to 0.6.0 instead of
installing them unpinned at runtime, resolving the zizmor adhoc-packages
finding. Also drops the no-op --save-dev flag (meaningless for a global
install).
Resolves code-scanning alert #2557
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>