What

Adds examples/sarif-upload.yml — a copy-paste workflow that uploads HookTripwire's SARIF to GitHub code scanning — and links it from the README's GitHub Actions section.

Per the acceptance criteria:

• step roles are explicit: the audit step runs mockingbird777/hooktripwire with format: sarif + an explicit output path and owns the job's pass/fail via fail-on: high; the upload step is github/codeql-action/upload-sarif
• if: always() interaction documented in comments: the upload runs even when the audit step fails the job so findings reach the Security tab, while the job's final result still comes from the audit threshold
• fork-PR permission boundary: workflows from fork PRs don't receive security-events: write, so the upload step is conditionally skipped (head.repo.full_name == github.repository) rather than suggesting broader credentials; fail-on still gates those runs
• least privilege & pinning: contents: read + security-events: write only; checkout reuses the repo's existing SHA pin, upload-sarif is pinned to the v4.37.1 full SHA, and the composite Action itself is pinned to the v0.2.0 release commit SHA
• no pull_request_target, no shell interpolation of untrusted values (the workflow has no run: steps at all)

Verification

• YAML parses (yaml.safe_load)
• npm test: 55/56 — the one failure (does not follow symbolic links) is pre-existing on my Windows machine (symlink creation requires elevation) and fails identically on a clean checkout
• npm audit: 0 vulnerabilities

Fixes #2