(fix): Fix nested action outputs

[franciscojuniorharness]

Summary

• Output discovery only looked at the cloned repo root action.yml, so path-based actions (owner/repo/path/to/action@ref) never exported outputs to Harness.
• ParseLookup now returns the action subdirectory, and we resolve <clone>/<path>/action.yml (with path-traversal guards). Root-level actions are unchanged.
• Fixes nested composite wrappers (e.g. .github/actions/...) that run successfully but leave Harness output variables empty (No output variables detected in action.yml; skipping output file generation.).
• Pins the plugin base image from floating docker:dind to docker:29.6.0-dind to avoid Docker 29.7.0 CopyToContainer regression (path escapes from parent under /var/run/act).
• Adds unit coverage for nested path discovery and ActionDir traversal cases that only escape after filepath.Clean.

Test plan

• Unit tests for root vs nested uses, nested outputs, missing nested action.yml soft-fail, and path-traversal rejection
• Verified via Docker: docker run --rm -v "$PWD":/src -w /src golang:1.22.7 go test ./... -count=1 -v
• Built temp image and validated nested action in Harness (fjunior87/ci-py-test/.github/actions/sample-tag@main)
  • Logs show Path: .github/actions/sample-tag
  • output variables step runs
  • Harness step outputs populated (new_tag, new_version)
• Confirmed old plugins/github-actions:latest fails the same nested repro (empty outputs)
• Validated root action (mathieudutour/github-tag-action@v6.2) with pinned DinD base — no path escapes from parent failure; outputs exported

[Ompragash]

LGTM. confirmed the nested action exports