fix: isolate composite action inputs from environment

[tianrking]

Fixes #2874.

What changed

• Keep composite-action inputs in the expression evaluator's inputs context instead of exporting them as automatic INPUT_* environment variables.
• Continue exposing explicit inputs to nested JavaScript actions, while preventing the parent composite action's inputs from leaking into child processes.
• Refresh both the environment and the resolved input context for remote composite actions between pre, main, and post stages.
• Add unit coverage plus Linux and Windows integration fixtures for explicit inputs, defaults, step conditions, nested composites, and JavaScript child actions.

This matches GitHub Actions behavior: composite actions read their own inputs through the inputs context, while JavaScript actions still receive their inputs through INPUT_* environment variables.

Validation

• go test ./pkg/runner -run '^(TestEvaluateCompositeInputsAndEnvAreIsolated|TestCompositeActionInputsStayInExpressionContext)$' -count=1
• go test ./pkg/runner -run '^TestRunEventHostEnvironment$/^uses-composite-input-context-windows$' -count=1
• go test ./pkg/runner -run '^$'
• go vet ./pkg/runner
• Reproduced the failure against the exact base commit with the same Windows integration fixture.

AI assistance (OpenAI Codex) was used to research the issue, implement and review the change, and run the validation described above.