GHC matrix drift automation opens a fix PR instead of a tracking issue

## Summary

Upgrade the GHC matrix drift check (landed in #160, closes #141) from
*filing a tracking issue* to *opening a PR* that applies the matrix and
`tested-with` update, validated by CI.

## Motivation

#160 detects when the matrix drifts from the non-EOL GHC set and files a
tracking issue a human then acts on. Closing the loop — auto-opening the
fix PR — removes the manual edit step. Split out of #141 rather than
bundled into #160 because the auto-PR path is blocked by infra
prerequisites #160 deliberately avoided (see Blocked by).

## Scope

- Reuse #160's detection (window = endoflife.date `eol: false`, with the
empty-set guard); this issue only adds the PR-opening.
- Generate the edits from the computed set:
- `ci.yml` matrix line (`ghc: [...]`),
- `ci.yml` coverage job's newest-GHC pin,
- the cabal `tested-with:` block (multi-line continuation),
- the cabal `base` bound when the floor/ceiling series changes.
- Replace the file-issue step with `peter-evans/create-pull-request`,
opening/refreshing a single branch (e.g. `automation/ghc-matrix`)
idempotently.
- Workflow `permissions: contents: write, pull-requests: write`.
- Author the PR with a GitHub App token (`actions/create-github-app-token`)
so `ci.yml` runs on it — a PR opened with the default `GITHUB_TOKEN`
does not trigger `on: pull_request` workflows, and validating the new
matrix build is the whole point.
- Do **not** bump `version:` — bumps happen at the release cut, not in
the generated PR.

## Blocked by

#307 — the GitHub App, its installation on this repo, and the App ID +
private key secrets. Tracked there rather than as checkboxes here
because #161 needs the same token.

"Allow GitHub Actions to create and approve pull requests" was listed
here as a third prerequisite. That setting gates `GITHUB_TOKEN`, not App
installation tokens, so it is not required.

## Acceptance criteria

- [ ] On drift, a PR is opened/refreshed updating the `ci.yml` matrix,
the coverage-job pin, the cabal `tested-with`, and the `base` bound
to the current non-EOL set.
- [ ] `ci.yml` runs on that PR (App-authored, not `GITHUB_TOKEN`).
- [ ] No drift → no PR; empty/degenerate computed set → no PR and a loud
failure.
- [ ] The generated PR does not touch `version:`.

## Additional context

- Builds on #141 (policy) and #160 (detect + file issue).
- Sibling `network-uri-json` has the same drift problem at worse scale
(`tested-with` stops before 9.0); this automation is a port candidate.