fix: use github.action_path instead of checking out action repo
github.action_repository/ref inside a composite action resolve to the
current step's action (actions/checkout), not the parent composite
action. Use github.action_path which points to the already-downloaded
action source.