claude-user-request.txt is written from the unsanitized trigger comment, so hidden content bypasses sanitizeContent

**Type:** bug / prompt-injection hardening
**Severity:** medium-high
**Area:** `src/create-prompt/index.ts`, consumed by `base-action/src/run-claude-sdk.ts`
**Effort:** small

## Summary

The prompt wraps the trigger comment in `sanitizeContent` (`src/create-prompt/index.ts` around lines 577 and 710) and tells the model that block is the only source of instructions. But `extractUserRequestFromContext` (around lines 910-918) runs `extractUserRequest` on the **raw** `eventData.commentBody` / `githubData.contextData.body`, and the result is written unsanitized to `claude-user-request.txt` (around lines 973-978). `base-action/src/run-claude-sdk.ts` (around lines 45-83) then sends that file as a second `text` block of the same user message.

So everything `docs/security.md` says is stripped (HTML comments, invisible characters, image alt text, hidden attributes) reaches the model anyway through the second block. `allowed_non_write_users` explicitly supports untrusted trigger authors.

## Reproduction

Trigger comment:

```
@claude summarize this issue please  ok
```

Running the real `createPrompt` with `RUNNER_TEMP` pointed at a scratch directory:

```
trigger_comment block in claude-prompt.txt (sanitized):
"@claude summarize this issue please  ok"
claude-user-request.txt (2nd content block):
"summarize this issue please  ok"
```

Every marker (`