New optional input `config-inline` accepts a JSON string carrying the pkg
config directly in the workflow. The orchestrator writes it to
`${invocationDir}/pkg-config.inline.json` and forwards that path to pkg via
`--config`. Mutually exclusive with `config`; the pair is validated at parse
time alongside a JSON-object syntax check so a typo fails before pkg runs.

Motivation: users with a trivial pkg config (entry + a couple of knobs) no
longer need to commit a separate .pkgrc.json just to customize the build.
Keeps the "pkg owns its schema" property — users still write pkg config
keys (camelCase), we just let them write them inline.

Not masked as a secret — README adds a note warning users against embedding
secrets in the value.

Docs: README gains an "Inline config" subsection with an example; action.yml
+ docs/inputs.md regenerated.

Tests: four new unit tests cover the happy path, mutual exclusion, invalid
JSON, and non-object JSON (string/array/null). 227/227 pass.

Three nits from the Copilot review on PR #13:
- targets.ts cross-compile warnings referenced `fallback-to-source` (kebab,
  like the retired CLI flag); pkg config uses `fallbackToSource` (camelCase).
  Reword both messages to point at the actual config key.
- README "pkg configuration" example was fenced as jsonc with a `//` comment
  and trailing comma but labeled `.pkgrc.json` — .pkgrc.json is strict JSON,
  so a copy/paste would fail. Move the filename into the prose, fence as
  json, drop the comment + trailing comma.

Unit tests + lint green. Matrix bundle rebuilt to pick up the new warning
strings.

# Conflicts:
#	action.yml
#	docs/inputs.md
#	packages/build/action.yml
#	packages/build/dist/index.mjs
#	packages/build/src/main.ts
#	packages/core/src/inputs.ts
#	packages/core/test/unit/inputs.test.ts
#	packages/windows-metadata/dist/index.mjs

Main (PR #12) wired the claude-code-smoke job through the action using
`mode: sea` and `compress-node: Zstd` inputs. Those inputs no longer exist
on this branch, so move both values into the package.json#pkg field that
the fixture-prep step already injects. No behavior change on main; on this
branch the e2e now exercises the pkg-config path the slim input surface
forces users onto.

The merge from main brought in the claude-code-smoke job, which previously
drove pkg via `mode: sea` + `compress-node: Zstd` action inputs. On this
branch those inputs are dropped. The prior merge-conflict resolution moved
both into `package.json#pkg` under the assumption that pkg config would pick
them up. That assumption was wrong:

- `mode: 'sea'` is not a pkg config key — the correct key is `sea: true`.
  (This was a user-visible bug; pkg silently ignored `mode` and ran
  standard-mode, which OOM'd trying to bytecode-compile claude-code's ESM
  bundle on macos-arm64.)
- `compressNode` / `compress` is not a pkg config key at all. `--compress`
  is CLI-only today on @yao-pkg/pkg. No config equivalent exists.

Fix the e2e:
- Write `sea: true` into package.json#pkg so SEA is actually enabled.
- Drop the Zstd request — there is no way to express it without the
  dropped CLI input. The job now exercises SEA + tar.gz; the Zstd branch
  is intentionally deferred until upstream lands config support.
- Rename + retone the job's comment block accordingly.

Also add an upstream-dependency note to STATUS.yaml and a draft issue
body at docs/upstream-pkg-config-issue.md. The draft asks yao-pkg/pkg to
accept the currently-CLI-only build flags (compress, fallbackToSource,
public, publicPackages, options, noBytecode, noDict, debug, signature)
in the config file — that's the piece that makes this PR's scope
defensible for the full input set, not just for SEA.

227 unit tests pass; lint + prettier clean.

Issue is open upstream asking @yao-pkg/pkg to accept the currently-CLI-only
build flags (compress, fallbackToSource, public, publicPackages, options,
noBytecode, noDict, debug, signature) in the config file — the piece that
makes this PR's drop-the-CLI-mirror direction fully viable.

Replace the local draft with the issue URL in STATUS.yaml#upstream-dependency.