fix(action): harden execution contract and summaries

[msaad00]

Summary

• replace shell-built action args with safe argv execution
• add pip caching and step summary output to the composite action
• expose explicit scan-status output and lock the contract with tests

Testing

• UV_CACHE_DIR=/tmp/agent-bom-uv-cache uv run pytest -q tests/test_ai_enrich.py -k action_yml