fix: strip unused ALL_INPUTS environment variable from Claude subprocess env

[Juwan-Hwang]

Summary

This PR ensures the ALL_INPUTS environment variable is stripped when preparing the environment dictionary passed to the Claude Code SDK subprocess in base-action/src/parse-sdk-options.ts.

Rationale & Context

• In action.yml, ALL_INPUTS: ${{ toJson(inputs) }} is exported to capture the full workflow inputs JSON.
• ALL_INPUTS is only consumed during initial action setup by collectActionInputsPresence() to compute input presence flags.
• The downstream Claude CLI/SDK subprocess does not require or consume ALL_INPUTS.
• As a defense-in-depth security hardening measure, removing ALL_INPUTS from env alongside existing OIDC token variable cleanups (ACTIONS_ID_TOKEN_REQUEST_*) prevents unnecessary aggregation of workflow inputs in the subprocess execution environment, adhering to the principle of least privilege.

Changes

• Stripped ALL_INPUTS in base-action/src/parse-sdk-options.ts during SDK environment construction.
• Added a unit test in base-action/test/parse-sdk-options.test.ts to verify ALL_INPUTS is stripped from sdkOptions.env.

Verification

• Ran typecheck via npm run typecheck in base-action (0 errors).
• Formatted via Prettier.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.