[TechEngineBot]

What

TechEngineBot now opens collection PRs instead of the maintainer's account. The maintainer still runs open-collect-pr.sh by hand, and their account still pushes the task's collect/* branch. Only the gh pr create, gh pr edit and gh pr ready calls run as TechEngineBot.

• TechEngineBot's gh login lives in its own config directory, ~/.config/gh-techenginebot, or TECHENGINEBOT_GH_CONFIG_DIR if set. The maintainer's own gh login is never used for the PR, and never changed.
• Before it pushes anything, the script checks that this login is TechEngineBot. If it isn't, the script stops and prints the one-time login command.
• These calls ignore GH_TOKEN and GITHUB_TOKEN, so a token in the environment can't open the PR as another account.
• README.md and the header of collect.yml now say the same.

Why

PRs are now opened by TechEngineBot, never by a workflow:

• collect.yml's token stays read-only.
• "Allow GitHub Actions to create and approve pull requests" is off in every repository of the org.

So no workflow can open or approve a PR.

TechAPI's Actions policy now also lets TechEngineBot trigger workflows, so pr-checks runs on the PRs it opens. TechEngineBot opened this PR itself.

Checks

• bash -n passes.
• With no TechEngineBot login, the script stops at the check and prints the login command. It gets there before it fetches or pushes anything. It does the same when GH_TOKEN holds another account's token.
• With the login in place, gh api user under that config answers TechEngineBot, and the maintainer's own gh login is unchanged.
• No data, engine or site change.

Closes #297