Support pixel privacy review automation

[ladamski]

https://app.asana.com/1/137249556945/project/1205243787707480/task/1214512208674130?focus=true

The composite action runs create-asana-task, which sets a taskId output on its inner step. Callers (per-repo privacy-review.yml workflows) had no way to read this — composite actions don't propagate inner step outputs unless declared. Expose them now so callers can chain follow-up automation like dispatching the AI Privacy Review classifier in duckduckgo/privacy-review-automation.

• triage_task_id: GID of the Privacy Triage task this action just created
• triage_task_permalink: built from the hardcoded project + the GID
• original_task_id: GID matched from the PR description by find-asana-task-id

No behavior change inside the action itself; outputs only.

After merging, cut a new tag (eg. v2.4) so per-repo workflows can pin to the version that exposes these outputs.

---

Note

Medium Risk
Introduces a new cross-repo workflow_dispatch call that depends on github_pat permissions and a non-main workflow ref, which could trigger unintended automation if misconfigured.

Overview
After creating the Asana privacy triage task, the composite action now dispatches the privacy-review-classifier.lock.yml workflow in duckduckgo/privacy-review-automation, passing pr_url and the created privacy_triage_task_id.

Also bumps this package/action version from 1.3.0 to 2.4.0 in package.json and package-lock.json.

^{Reviewed by Cursor Bugbot for commit 12bd807. Bugbot is set up for automated code reviews on this repo. Configure here.}

[nshuba]

LGTM, but looks like there's a lint failure

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 79e3a27. Configure here.}