Add pull request finding comparison - #8

Summary

• add --compare <report.json> with validated, multiset finding comparison
• classify findings as new, existing, and resolved; fail CI only on new findings
• expose comparison data in HTML, JSON, SARIF, and the GitHub Action
• document a main-branch artifact workflow and release as v0.4.0

Verification

• pnpm check (9 files, 50 tests)
• pnpm build
• pnpm pack --dry-run
• Action smoke double scan: 0 new / 8 existing / 0 resolved
• real CLI exit semantics: 0 for self-compare, 1 for a new error, 2 for invalid baseline
• actionlint on all workflows