fix: rate limit violation - #3

Reviewer model: GPT Sol

APPROVE — No blocking findings.

The per-registry start gate reserves slots before sleeping and, with crates.io configured for one in-flight request and a 1000 ms minimum start interval, keeps API request starts at least one second apart without delaying npm or pub.dev lookups. Coverage exercises exact fake-clock spacing, slow requests, real elapsed time, other registries, end-to-end behavior, and the committed action bundle.

Validation:

• git diff --check 32aabd71...bb0679f — passed
• npm run typecheck — passed
• npm test — 107/107 passed
• npm run build plus a clean diff against actions/dependency-cooldown/dist — passed; the bundle is reproducible
• GitHub CI dependency-cooldown package — passed at bb0679f

No blocking findings remain.