Strip OIDC token request env vars from Claude session environment

[MaxwellCalkin]

Summary

Fixes #1010

The Claude session environment is built by spreading process.env in parseSdkOptions() (base-action/src/parse-sdk-options.ts). When the workflow has id-token: write permission, this includes:

• ACTIONS_ID_TOKEN_REQUEST_URL — the GitHub OIDC token endpoint
• ACTIONS_ID_TOKEN_REQUEST_TOKEN — the bearer token to call that endpoint
• ACTIONS_RUNTIME_TOKEN — the Actions runtime authentication token

These variables allow the Claude session to mint arbitrary OIDC tokens, which can be exchanged for credentials to cloud providers (AWS, GCP, Azure) configured to trust the repository's OIDC identity. This is a privilege escalation — the id-token: write permission is intended for the action's own authentication (in src/github/token.ts), not for the Claude session.

Changes

• base-action/src/parse-sdk-options.ts: Delete ACTIONS_ID_TOKEN_REQUEST_URL, ACTIONS_ID_TOKEN_REQUEST_TOKEN, and ACTIONS_RUNTIME_TOKEN from the env object after spreading process.env, before passing it to the SDK.
• base-action/test/parse-sdk-options.test.ts: Add test verifying these variables are stripped from sdkOptions.env.

Test plan

• Existing tests pass (no env vars relied on these being present in the Claude session)
• New test confirms all three variables are stripped from sdkOptions.env even when set in process.env
• Workflows using OIDC auth (Bedrock, Vertex, Foundry) continue to work — the action's own token exchange in token.ts reads from process.env directly, before parseSdkOptions() is called