fix: address verified review findings (actions-workflows-values-1)

Signed-off-by: bircni <bircni@icloud.com>

docs/migration-1.0.md

@@ -284,7 +284,7 @@ changed meaning:
 | `repo delete` | `--name NAME --owner OWNER` | optional `OWNER/REPO` argument (or `--repo`) |
 | `pulls close\|reopen\|edit` | several indexes | `pr close\|reopen\|edit` take one pull request (number, URL or branch); loop to change several |
 | `issue comment` | optional body argument | `--body`, `--body-file` or `--editor` |
-| `secret set`, `variable set` | `<name> [<value>]`, `--file`, `--stdin` | value from `--body`, `--body-file FILE\|-` or piped standard input |
+| `secret set`, `variable set` | optional value argument, `--file`, `--stdin` | `--body VALUE`, `--body-file FILE` (or `-`), or standard input; one trailing line break is removed |
 
 A number is read as an ID; pass `--by-name` to match a milestone, label or asset
 whose name is a number. Destructive commands still ask for confirmation unless
@@ -409,9 +409,10 @@ archive, or run `make docs`.
 - More input is checked before anything is sent: release titles, issue titles
   and comment bodies cannot be empty, a review needs a body or inline comments
   (unless it approves), team creation needs a permission, migrations from
-  GitHub, Gitea, GitLab and Gogs need an access token, and `workflow run` must find
-  its workflow and check the inputs (without `--ref` it uses the checked-out
-  branch, else the default branch).
+  GitHub, Gitea, GitLab and Gogs need an access token. `workflow run` uses the
+  checked-out branch (which must be on the server) or the default branch when
+  there is no `--ref`, and refuses unknown inputs, missing required inputs and
+  values that a choice, boolean or number input does not accept.
 - `pr merge` merges the head it read and refuses when the branch moved in the
   meantime; run it again to merge the new head.
 - Preferences follow the git/gh order: an explicit `tea config set` value wins