fix: use INPUT_ prefix for allowed/disallowed tools environment variables

The base action expects INPUT_ALLOWED_TOOLS and INPUT_DISALLOWED_TOOLS
(following GitHub Actions input naming convention) but we were exporting
them without the INPUT_ prefix. This was causing the tools to not be
properly allowed in the base action.

test-review.md

@@ -0,0 +1,33 @@
+# Test Review Mode
+
+This is a test file to demonstrate the review mode functionality.
+
+## Features to Review
+
+- Code quality analysis
+- Security vulnerability detection
+- Performance optimization suggestions
+- Best practices enforcement
+
+## Test Code
+
+```javascript
+function processUser(user) {
+    // Potential issues for review:
+    // 1. No input validation
+    // 2. No error handling
+    var name = user.name;
+    var age = user.age;
+    
+    if (age > 18) {
+        console.log(name + " is an adult");
+    }
+    
+    // SQL injection vulnerability
+    const query = "SELECT * FROM users WHERE name = '" + name + "'";
+    
+    return query;
+}
+```
+
+This code has several issues that the review mode should catch.