docs/capabilities-and-limitations.md presents the removed allowed_tools input as current configuration

## Summary

[`docs/capabilities-and-limitations.md#L22`](https://github.com/anthropics/claude-code-action/blob/d721746d683d812e669ce117cebe55a85fbd9c3e/docs/capabilities-and-limitations.md#L22) tells users to configure tool access with the `allowed_tools` input, which was removed in v1.0. Every other page in `docs/` lists that input as deprecated; this is the one place it still reads as current guidance.

## The line

> - **Run Arbitrary Bash Commands**: By default, Claude cannot execute Bash commands unless explicitly allowed using the `allowed_tools` configuration

`allowed_tools` is not a declared input in `action.yml`. The replacement is `claude_args` with `--allowedTools`.

## Why this one is different from the other mentions

`allowed_tools` appears in several other docs, but always correctly marked as removed:

- `docs/configuration.md:342` — migration table: `` `allowed_tools` | Use `claude_args: "--allowedTools Tool1,Tool2"` ``
- `docs/usage.md:106` — `` `allowed_tools` | **DEPRECATED**: Use `claude_args` with `--allowedTools` instead ``

Those are intentional and should stay. `capabilities-and-limitations.md` is the only occurrence phrased as a live instruction, in a document a new user is likely to read early — it is linked from the README as "What Claude can and cannot do".

## Suggested fix

Reword to reference the current input:

> - **Run Arbitrary Bash Commands**: By default, Claude cannot execute Bash commands unless explicitly allowed via `claude_args` with `--allowedTools`

## Related trivial cleanup in the same area

Unrelated to the docs, but too small to merit its own issue — [`src/github/validation/trigger.ts#L128-L130`](https://github.com/anthropics/claude-code-action/blob/d721746d683d812e669ce117cebe55a85fbd9c3e/src/github/validation/trigger.ts#L128-L130) has a ternary whose branches are identical:

```ts
const commentBody = isIssueCommentEvent(context)
? context.payload.comment.body
: context.payload.comment.body;
```

Both `IssueCommentEvent` and `PullRequestReviewCommentEvent` expose `payload.comment.body`, so this reduces to `const commentBody = context.payload.comment.body;`. No behaviour change — the discriminated-union narrowing is already satisfied by the enclosing `if`.

Happy to fold both into one small PR, or to drop the second if you'd rather keep docs changes separate from source changes.

## Environment

- Repository at `d721746d683d812e669ce117cebe55a85fbd9c3e` (`main`)