feat: make .github/workflows modification restriction configurable

## Problem

The system prompt in `src/create-prompt/index.ts` (line 849) unconditionally tells Claude:

> You CANNOT modify files in the .github/workflows directory (GitHub App permissions do not allow workflow modifications)

This restriction makes sense when using Anthropic's hosted GitHub App, which does not request `workflows:write`. However, organizations using **their own GitHub App tokens** (via `github_token` input) may have explicitly granted `workflows:write` to their app.

In our case (Doctolib), we use a custom GitHub App with `workflows:write` permission granted via Vault. We added this permission specifically so Claude agents can fix CI workflow issues autonomously. The permission is real and working at the API level, but Claude refuses to use it because the prompt tells it not to.

## Current behavior

The restriction is hardcoded in `generateDefaultPrompt()` with no flag to disable it. The only workaround is:
- Appending a contradicting override instruction via `prompt` (unreliable since it fights the earlier system prompt)

`USE_SIMPLE_PROMPT=true` removes the restriction but also drops most useful default instructions (~180 lines → ~70 lines: no 5-step workflow, no analysis thinking, no capabilities section, no comment tool examples). Agent mode bypasses the default prompt entirely but is auto-detected based on event type — it's not a user-selectable option.

## Proposed solution

Add an optional boolean input, e.g. `allow_workflow_modifications`:

```yaml
inputs:
allow_workflow_modifications:
description: "Allow Claude to modify .github/workflows/ files. Set to true if your github_token has workflows:write permission."
default: "false"
```

When `true`, omit the workflow restriction line from the generated prompt (or replace it with a positive instruction).

This is low-risk since:
- It defaults to `false` (no behavior change)
- The restriction is prompt-based only (no tool-level block exists today)
- Organizations opting in have already made the security decision by granting `workflows:write`

## Context

- Related to closed #128 ("Why can't claude code make changes to the .yml's in .github?")
- Listed on the [ROADMAP](https://github.com/anthropics/claude-code-action/blob/main/ROADMAP.md) as "Ability to modify workflow files"
- The FAQ acknowledges this may be reconsidered in the future

Start in src/create-prompt/index.ts around generateDefaultPrompt() and the restriction at line 849, then trace how GitHub Action inputs reach prompt generation. Verify the existing input definitions and tests, if present. Done means the default behavior remains unchanged while an explicitly enabled option allows workflow modifications without removing the other default instructions.

Written by the indexing model from the issue text.