Add a first-class duration input

[rizaziz]

Closes #250.

Summary

Adds an optional, typed duration input (seconds) that maps to the Mayhem CLI --duration flag, so run length no longer has to be threaded through the free-form args string — where precedence was unclear and a ref (e.g. long-runs) could silently clobber a value passed via args.

Precedence

1. the duration input wins — it replaces any --duration already present in args;
2. else honor --duration in args;
3. else the documented default of 60 seconds.

Details

• Validates the input is a positive integer ("0", "-5", "20m", "1.5" are rejected with a clear error; empty = unset).
• Echoes the effective duration to the run log in every branch (e.g. Duration: 1200s (from the 'duration' input).) so overrides are visible — directly addressing the "silently became 4 hours" problem in the issue.
• dist/ rebuilt reproducibly via make dist-rebuild.
• README.md and action.yml document the new input.

Also included

Bumps the action runtime from node20 to node24 (action.yml). This is the GitHub Actions runtime and is independent of the node:20 Docker image used to build dist/.

Testing

tsc build, prettier format-check, eslint, ncc package, and jest all pass. The existing test already exercises INPUT_DURATION.

[github-actions]

Mayhem Automated Code Testing Report

❗ 1 Defects Found

CWE Severity	Defect	Description
7.1	Improper Input Validation	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

---

Testing details found at https://app.mayhem.security/forallsecure/mcode-action/mayhemit/39

[d-dot-one]

The code looks good. Since I'm not familiar yet with this repo, the only change I would see is to test for the rejection cases (0, negative, fractional, non-numeric) in duration (the existing test only covers a single value of 10).