v2.0.3

Audit follow-ups and local-mutex pin bump. No user-visible behavior changes on the happy path.

Changes

• Pin hygiene. actions/checkout@v6 pinned to @v6.0.2 in all three CI jobs. Repo policy is hard-pinning on every ecosystem.
• Save excludes restore marker. lib/cache-save.sh now passes --exclude=.local-cache-restore to rsync when copying the source into the new entry. On the canonical restore -> install -> save pattern, a prefix-hit restore previously left a stale marker file inside the new on-disk entry. Harmless at runtime but pollutes cache entries with stale metadata.
• Prefix marker-skip is now covered by CI. Existing tests exercised exact-hit-skip and prefix-match-first-time but not prefix-match-second-time-skip (the is_exact="false" branch in is_current). New CI steps cover both the marker-skip and the save-exclude behaviors.
• Constant-time marker-skip restored. lib/cache-restore.sh previously ran find ${entries_dir}/ | wc -l unconditionally to populate a ::debug:: log line, contradicting the README's constant-time claim on the happy path. The call is now gated behind RUNNER_DEBUG=1.
• MARKER_VERSION constant. The inline v2: literal in lib/cache-restore.sh is now a single constant referenced in both is_current and the marker write. .github/workflows/ci.yml keeps its assertion literals with a comment pointing at the canonical source.
• Marketplace name symmetry. save/action.yml renamed to Runner Local Cache (Save) to match action.yml's Runner Local Cache.
• README polish. rm command now uses entries/* in both examples (matching semantics). Marker-match wording clarified for the prefix-hit path.
• curlewlabs-com/local-mutex@v1.0.0 -> @v1.0.1. The sister action just shipped a patch release; local-cache consumes the latest.

Pinned users on @v2 pick this up automatically. Users pinned to @v2.0.2 can bump to @v2.0.3.