Translation PRs run no CI checks

`crowdin-rx.yml:38` creates the translation pull request with `secrets.GITHUB_TOKEN`. GitHub does not start workflow runs for events raised by that token, so the `l10n/crowdin` PR arrives with **no checks at all**.

That was harmless before CI existed. It is not now: #17 added `ci.yml` on `pull_request`, and translations are the one input that can break the build without any human writing Dart. A malformed or truncated `.arb` fails `flutter gen-l10n`, which `flutter pub get` runs through `generate: true` — so a bad translation merges green and then breaks every subsequent build and every release job.

Evidence: PRs #12 and #15, both from `l10n/crowdin`, both merged, both with zero status checks.

ChameleonUltraGUI hit the same wall and solved it by having the bot own the PR — `peter-evans/create-pull-request` with `push-to-fork:` a bot account's fork and a `BOT_HELPER_TOKEN`, so the PR is authored by a real account and triggers workflows normally.

Options, cheapest first:

- [ ] **A PAT or a GitHub App token** for the Crowdin action's `GITHUB_TOKEN`. One secret, no other change. A fine-grained PAT scoped to this repo with contents+PR write is enough.
- [ ] **Bot account plus fork**, the ChameleonUltraGUI shape. More moving parts, but the PR is attributable to a bot rather than to a maintainer's PAT.
- [ ] **A `workflow_run` trigger** on the RX workflow that runs analyze/test against the branch. Avoids new credentials but duplicates CI's definition and reports outside the PR's own checks.

Whichever is chosen, verify by confirming the next `l10n/crowdin` PR shows the "Analyze and test" check.