[Advanced] Reusable GitHub Action: verify a published LCP document in CI

[Eras256]

Context
Once a standalone LCP verifier exists (see the companion issue in this repo), a downstream repo — starting with this one — should be able to add one CI step that fails the build if a tenant's live LCP document does not hash-match its own declared value, closing the loop between "we say it's verifiable" and someone actually checking it on every push.

Scope
A composite (or Docker) GitHub Action wrapping the LCP verifier CLI:

• Inputs: domain (or url), optional expected-hash to pin against a specific known-good value instead of just self-consistency.
• Fails the step on any mismatch or unreachable document.
• Published under .github/actions/verify-lcp in this repo (or as its own repo, if cleaner — justify the choice in the PR).

Acceptance criteria

• Example workflow YAML included, and actually wired into this repo's own .github/workflows/ci.yml as a real step — proven to run and pass against the live demo tenant on a real PR, not just documented.
• README for the action itself (inputs/outputs, example usage) so an external repo could adopt it too.

Depends on: the standalone LCP verifier issue — can be built against a linked branch/PR rather than waiting for it to merge first.