run-claude-cli: add an input that keeps user and project settings from loading #992

No related PR yet.

Problem

run-claude-cli (action.yml at b8bdd7f) has no input for --setting-sources, and lane.cjs builds its CLI flags without one. A lane that runs pull request code under the CLI, such as claude-code-plugins' pr-verify-capture.yml (melodic-software/claude-code-plugins#12232, PR melodic-software/claude-code-plugins#13536), lets head code write ~/.claude/settings.json or ./.claude/settings*.json mid-session. Managed settings outrank those files, and the capture now pins env.CLAUDE_CODE_SUBPROCESS_ENV_SCRUB and env.NODE_TLS_REJECT_UNAUTHORIZED there. Any setting the managed object does not pin still loads from head-written files.

Done when

• run-claude-cli takes an optional input that passes --setting-sources with user and project removed, with a test of the built argv.
• The README states which lanes should set it: any lane that runs pull request code.

Found by a security review of PR melodic-software/claude-code-plugins#13536 (finding P3, low confidence; mid-session reload is documented, its effect on env was not probed).