Harden Claude Code GitHub Actions: Prompt Injection Defense

Defend Claude Code workflows against the April 2026 Comment and Control CVE. Tool allowlists, OIDC via Bedrock, script caps, egress blocks, and a before/after hardened workflow.