Workflows author pull requests with a GitHub App token so CI runs on them

[alunduil]

Summary

Create a GitHub App with contents: write + pull requests: write,
install it on this repo, and store its App ID and private key as Actions
secrets, so scheduled workflows can open PRs and push tags that trigger
ci.yml and release.yml.

Motivation

A PR opened (or a tag pushed) with the default GITHUB_TOKEN does not
trigger on: pull_request / on: push workflows. Two automation issues
need their generated PRs validated by CI before a human sees them: #162
(GHC matrix drift auto-PR) and #161 (release PR, tag on merge). Neither
can be implemented today — the repo's only Actions secret is
CODECOV_TOKEN, so actions/create-github-app-token has nothing to
authenticate with and the workflow fails at the token step.

Scope

• Create the App under the alunduil account with repository
  permissions contents: write and pull requests: write.
• Install it on alunduil/collection-json.hs.
• Generate a private key and store AUTOMATION_APP_ID and
  AUTOMATION_APP_PRIVATE_KEY as repo Actions secrets.
• Scope the App at the account level rather than this repo alone —
  network-uri-json has the same GHC matrix drift problem and is a
  stated port target for GHC matrix drift automation opens a fix PR instead of a tracking issue #162's automation.

Acceptance criteria

• App exists with contents: write + pull requests: write,
  installed on this repo
• AUTOMATION_APP_ID and AUTOMATION_APP_PRIVATE_KEY present in
  Actions secrets
• Verified end to end: an App-authored PR triggers ci.yml (GHC matrix drift automation opens a fix PR instead of a tracking issue #162's
  implementation is the natural place to confirm this)

Additional context

Blocks #162 and #161. App creation, installation, and secrets are
manual; repo settings live in alunduil-infrastructure Terraform.

#162's body lists "Allow GitHub Actions to create and approve pull
requests" as a third prerequisite. That setting gates GITHUB_TOKEN,
not App installation tokens, so it isn't needed here.