feat(ci): deliver template updates as a pull request or an issue

[raederan]

What's Changed

The built-in token may not create or update files under .github/workflows/,
and template updates routinely do, so the second real backport was rejected at
the push. The first only succeeded because it happened to touch no workflow.

Updates now arrive as a pull request when a GitHub App with Workflows write is
available, and as an issue naming the command to run locally when it is not.
The merge is identical either way; only the automation differs. A new
update_bot answer gates the App path and both profile READMEs document the
one-time setup.

Checklist

• make ci passes locally (runs check, test and docs-test in one go)
• Commits follow Conventional Commits (the commit-msg hook enforces this)
• Docs updated where behaviour changed

[github-actions]

Release preview

Merging this PR would release v0.12.0 (current: v0.11.0).

Changelog preview (truncated)

## v0.12.0 (2026-08-11)

### Features

- **ci**: Deliver template updates as a pull request or an issue
  ([`b885247`](https://github.com/OO-LD/coregraft/commit/b885247d50d27792a9ca1cba82e0cafbce67e856))

_{Preview via python-semantic-release and conventional commits.}