CI checks don't run on release PRs created by release-plz

The `create-release-pr.yml` workflow uses `secrets.GITHUB_TOKEN` to create release PRs via release-plz. GitHub Actions has a [deliberate security feature](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow) that prevents events generated by `GITHUB_TOKEN` from triggering other workflows (to avoid infinite loops).

**Impact:** The CI workflow (`ci.yml` — lint + test jobs) never runs on release PRs. Only CodeQL runs because it uses a GitHub-managed dynamic trigger that bypasses this restriction.

**Observed on:** PR #315 (`release-plz-2026-04-10T22-16-06Z` → `main`) — no lint or test checks reported.

**Root cause:** Line 36 of `.github/workflows/create-release-pr.yml`:
```yaml
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
```

Since the PR is authored by `app/github-actions`, the `pull_request` event it generates does not trigger `ci.yml`.

**Fix options:**
1. Use a GitHub App installation token or PAT instead of `GITHUB_TOKEN` in the release workflow — a token from a different identity will allow downstream workflows to trigger.
2. Add a `workflow_run` trigger to `ci.yml` that fires after the release PR workflow completes (more complex).

**Workaround:** Close and reopen the PR, or push an empty commit to the branch — this generates a new event that will trigger CI.

_{*Generated via Copilot (Claude Opus 4.6) on behalf of @tclem*}