allowed_tools does not take effect when called twice

**Describe the bug**
When claude-code-action is called multiple times in a workflow, `allowed_tools` does not take effect in later calls.

**To Reproduce**
When the below workflow is run, the second one may fail due to lack of permission of `go` command.

```yaml
- uses: anthropics/claude-code-action@beta
with:
direct_prompt: ...

- uses: anthropics/claude-code-action@beta
with:
allowed_tools: |
Bash(go:*)
```

**Expected behavior**
The `allowed_tools` is independent from another call.

**API Provider**

[ ] Anthropic First-Party API (default)
[x] AWS Bedrock
[ ] GCP Vertex

**Additional context**
According to the logs, this action exports the following variables:

```yaml
env:
ALLOWED_TOOLS: Edit,MultiEdit,Glob,Grep,LS,Read,Write,mcp__github_comment__update_claude_comment,Bash(git add:*),Bash(git commit:*),Bash(git push:*),Bash(git status:*),Bash(git diff:*),Bash(git log:*),Bash(git rm:*),Bash(git config user.name:*),Bash(git config user.email:*)
DISALLOWED_TOOLS: WebSearch,WebFetch
```

I think the following code causes this problem.
https://github.com/anthropics/claude-code-action/blob/8fcb8e16b8c1353a2a862e146081ee0c2c254c0e/src/create-prompt/index.ts#L775-L776