CI artifacts

Wire reports into GitHub Actions workflows.

- uses: 277pawan/revenant-action@v1.0.3
  with:
    version: v0.1.1
    config: revenant.yaml
  env:
    DATABASE_URL: ${{ secrets.DATABASE_URL }}

- uses: actions/upload-artifact@v4
  if: always()
  with:
    name: revenant-evidence
    path: |
      report.json
      report.md

For AWS restore workflows, run revenant reap in a final step with if: always() so sandboxes never linger after failures.