docs: document safe action adoption

[Maxerns]

Summary

• explain the safest small path for installing an exact Sotto CLI release in GitHub Actions
• document action ref choices, including full commit-SHA pinning
• add basic, cross-platform matrix, Windows PowerShell, and reusable-workflow examples
• expand the checksum, Sigstore, version-validation, and secret-handling rationale

Why

Users need to pin the action itself and the CLI release independently. The README now makes the
immutable choices explicit while keeping the common workflow a short install step.

Testing

• checked the Markdown diff with git diff --check
• checked new prose for British English and repository punctuation rules