Replace out-of-scope CLA helper actions flagged by zizmor

Follow-up from #361.

The `check-cla` composite action currently keeps several helper actions that `zizmor --persona=auditor` reports as `superfluous-actions`. The PR leaves them in place to avoid a larger behavior rewrite and documents the ignores inline.

Current items to revisit:

- Replace `peter-evans/create-or-update-comment` usage for comment reactions with a `gh`/API script step, if practical.
- Replace `actions-ecosystem/action-add-labels` with a `gh issue edit --add-label` or API script step.
- Replace `actions-ecosystem/action-remove-labels` with a `gh issue edit --remove-label` or API script step.
- Replace `peter-evans/create-pull-request` with an equivalent `gh pr create` or API/script flow, if doing so preserves the current fork/branch/author behavior.
- Remove the corresponding inline `zizmor: ignore[superfluous-actions]` comments after the rewrites are complete.

Start with the check-cla composite action and run zizmor --persona=auditor to review the reported superfluous-actions. Compare each replacement against the current comment, label, and pull-request behavior, especially fork, branch, and author handling. Done means the helper actions are replaced where practical and the corresponding inline zizmor ignores are removed without changing behavior.

Written by the indexing model from the issue text.