CI checks don't run on release PRs created by release-plz

[tclem]

The create-release-pr.yml workflow uses secrets.GITHUB_TOKEN to create release PRs via release-plz. GitHub Actions has a deliberate security feature that prevents events generated by GITHUB_TOKEN from triggering other workflows (to avoid infinite loops).

Impact: The CI workflow (ci.yml — lint + test jobs) never runs on release PRs. Only CodeQL runs because it uses a GitHub-managed dynamic trigger that bypasses this restriction.

Observed on: PR #315 (release-plz-2026-04-10T22-16-06Z → main) — no lint or test checks reported.

Root cause: Line 36 of .github/workflows/create-release-pr.yml:

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Since the PR is authored by app/github-actions, the pull_request event it generates does not trigger ci.yml.

Fix options:

1. Use a GitHub App installation token or PAT instead of GITHUB_TOKEN in the release workflow — a token from a different identity will allow downstream workflows to trigger.
2. Add a workflow_run trigger to ci.yml that fires after the release PR workflow completes (more complex).

Workaround: Close and reopen the PR, or push an empty commit to the branch — this generates a new event that will trigger CI.

_{Generated via Copilot (Claude Opus 4.6) on behalf of @tclem}