Add initial implementation of PolinRider malware scanner

- Introduced core files including Dockerfile, action.yml, and entry point script (bin/polinrider.js) for the PolinRider malware scanner.
- Created configuration files: .env.example, .gitignore, and .npmrc for environment setup and dependency management.
- Added CI workflows for testing, building, and releasing the action, along with examples for usage in GitHub Actions.
- Implemented a README.md to provide documentation on usage, features, and setup instructions.
- Included necessary scripts for building the action and handling security measures during execution.
- Established a structured directory for reports and workspace management within Docker.
- Ensured all files are set up for a secure and efficient scanning process of GitHub repositories for PolinRider malware.

.env.example

@@ -0,0 +1,56 @@
+# Copy to .env and fill in. NEVER commit your real .env.
+#   cp .env.example .env
+#
+# Docker Compose auto-loads .env for variable substitution. For direct
+# `node bin/polinrider.js` runs, export these in your shell instead.
+
+# ─── Required ──────────────────────────────────────────────────────────────────
+
+# GitHub Personal Access Token (classic) with scopes: repo (full) + read:org.
+GH_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+# Target account — set EXACTLY ONE of the following (comment out the other).
+#   • GH_ORG  → scans every repo in the organization.
+#   • GH_USER → scans every repo you OWN under your personal account.
+# Your GitHub organization name (e.g. mycompany):
+GH_ORG=your-org-name
+# Your personal GitHub username (uncomment to clean personal repos instead):
+# GH_USER=your-username
+
+# ─── Recommended for a first run ─────────────────────────────────────────────────
+
+# Pilot against specific repo(s) before scanning the whole account. Comma-separated.
+# Each entry is "name" (the GH_ORG/GH_USER owner is prefixed) or "owner/name".
+# Leave empty to scan the entire account.
+#   GH_REPO=my-first-repo
+GH_REPO=
+
+# DRY_RUN=true scans + reports the planned surgical changes but writes nothing
+# and opens no PRs. Start with true; set to false only once you're satisfied.
+DRY_RUN=true
+
+# Auto-merge the cleanup PRs (default false). Respects branch protection: PRs that
+# require reviews/checks are left open and reported, not bypassed. Needs a token
+# with merge rights on the repos.
+AUTO_MERGE=false
+# Merge method when AUTO_MERGE=true: squash | merge | rebase.
+# MERGE_METHOD=squash
+
+# ─── Optional (sane defaults — usually leave unset) ──────────────────────────────
+
+# Where JSON + Markdown run reports are written (the container mounts ./reports
+# here). Set empty to disable report files.
+# REPORTS_DIR=reports
+
+# Where repos are cloned (the container provides /workspace via tmpfs).
+# WORKSPACE=/workspace
+
+# Where repos are cloned (the container provides /workspace via tmpfs).
+# WORKSPACE=/workspace
+
+# Branch name prefix for the cleanup PRs.
+# BRANCH_PREFIX=fix/polinrider-cleanup
+
+# Extra hardening: freeze built-in prototypes (--frozen-intrinsics). Experimental;
+# leave off unless you've confirmed it doesn't break the run.
+# POLINRIDER_FROZEN=1