fix(action): keep OCR runtime stable during review - #1204

Description

The composite GitHub Action installs an OCR runtime before configuration and review, but each ocr invocation can start the CLI's detached background updater.

When the npm registry contains a newer release, that updater can run npm i -g concurrently with later action steps. Besides changing the OCR version during one action execution, npm may temporarily remove the global ocr launcher and JavaScript package tree, causing subsequent ocr config or ocr review commands to fail.

This change disables CLI self-update only for OCR invocations owned by the composite Action (OCR_NO_UPDATE: "1" step-level env on the Install / Configure / Run steps — the step-level scope keeps it out of the caller's job environment). Standalone CLI behavior is unchanged: the launcher's updater still runs exactly as before for direct ocr users.

The contract holds regardless of the ocr_version input (exact pin, range, or latest): the Action has already performed its own installation, so the runtime should not change again during that execution.

Relation to #704

#704 addresses resilience of the generic npm auto-upgrade path with a staged native-binary fallback. This PR is intentionally narrower: the GitHub Action already owns OCR installation for one review execution, so it avoids entering that background upgrade path during the action.

The action-level fix also covers launcher / JavaScript-package removal cases where a native-binary fallback cannot run because the launcher itself is temporarily unavailable (exit 127 ocr: command not found, or Cannot find module '/usr/local/bin/ocr' while npm replaces the global package tree).

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Refactoring (no functional changes)
• Documentation update
• CI / Build / Tooling

How Has This Been Tested?

Regression test: a new action-contract test (static YAML contract + executed shell-block contract via the existing fake-ocr harness) fails on upstream/main before the fix and passes after it.

Negative control (upstream/main worktree + test patch only):

not ok - every action-owned ocr invocation disables CLI self-update:
  step Install OpenCodeReview invokes ocr and must disable CLI self-update
  (env OCR_NO_UPDATE: "1")   — process exit 1

After the fix, all gates pass locally:

• node scripts/github-actions/action-contract.test.js — 41/41 PASS
• npm run test:github-actions — PASS
• npm run test:launcher — PASS (standalone launcher auto-update behavior unchanged)
• npm run test:update — PASS
• make check — PASS
• make test — PASS
• make build — PASS

External hosted GitHub Actions reproduction (not part of this repo):

OCR installed: 1.11.6
registry latest: 1.11.7

auto-update enabled:  7/7 runs failed
OCR_NO_UPDATE=1:      10/10 runs passed

Observed during failing runs: detached scripts/update.js -> npm i -g 1.11.7 -> global launcher/package-tree replacement with a 0.66-0.89 s unavailable window -> subsequent ocr config failing with exit 127 or MODULE_NOT_FOUND.

Checklist

• My code follows the project's coding style (go fmt, go vet)
• I have performed a self-review of my code
• I have added tests that prove my fix is effective or my feature works
• New and existing unit tests pass locally with my changes
• I have updated the documentation accordingly (if applicable) — no documentation change needed: this only makes the Action's existing installed runtime stable during its execution; standalone CLI behavior is unchanged
• I have signed the CLA

Related Issues

Related to #703.
Complementary to #704.