fix: address review feedback on auth inputs and dead base-action options

- Drop anthropic_api_key from repo workflows: only CLAUDE_CODE_OAUTH_TOKEN
  is configured as a secret, and upstream docs say to pick one auth path
- Replace the undeclared allowed_tools input in test workflows with
  claude_args --allowedTools (base-action only declares claude_args)
- Remove dead ClaudeOptions fields and INPUT_* reads that prepareRunConfig
  never consumed (mcp_config, allowed_tools, max_turns, system prompts, etc.)
- Update base-action README to document the actual inputs, with former
  dedicated inputs expressed as Claude CLI flags via claude_args

base-action/src/index.ts

@@ -22,15 +22,6 @@ async function run() {
 
     await runClaude(promptConfig.path, {
       claudeArgs: process.env.INPUT_CLAUDE_ARGS,
-      allowedTools: process.env.INPUT_ALLOWED_TOOLS,
-      disallowedTools: process.env.INPUT_DISALLOWED_TOOLS,
-      maxTurns: process.env.INPUT_MAX_TURNS,
-      mcpConfig: process.env.INPUT_MCP_CONFIG,
-      systemPrompt: process.env.INPUT_SYSTEM_PROMPT,
-      appendSystemPrompt: process.env.INPUT_APPEND_SYSTEM_PROMPT,
-      claudeEnv: process.env.INPUT_CLAUDE_ENV,
-      fallbackModel: process.env.INPUT_FALLBACK_MODEL,
-      model: process.env.ANTHROPIC_MODEL,
       pathToClaudeCodeExecutable:
         process.env.INPUT_PATH_TO_CLAUDE_CODE_EXECUTABLE,
     });

base-action/src/run-claude.ts

@@ -14,16 +14,7 @@ const BASE_ARGS = ["--verbose", "--output-format", "stream-json"];
 
 export type ClaudeOptions = {
   claudeArgs?: string;
-  model?: string;
   pathToClaudeCodeExecutable?: string;
-  allowedTools?: string;
-  disallowedTools?: string;
-  maxTurns?: string;
-  mcpConfig?: string;
-  systemPrompt?: string;
-  appendSystemPrompt?: string;
-  claudeEnv?: string;
-  fallbackModel?: string;
 };
 
 type PreparedConfig = {