README: stop teaching the patterns we removed everywhere else

[pavel-te]

The CI/CD section still described the world before ptc-action, and every
defect it taught is one we fixed elsewhere and then shipped a doc
contradicting.

• The GitHub Actions example was a hand-rolled job with
  peter-evans/create-pull-request@v5 — an unpinned movable tag on a
  third-party action, i.e. a write-access foothold. It now leads with
  ptc-action; the manual steps survive in a
  Details

  block with the SHA pin,
  the sha256 check and the stable ptc/translations branch, so a reader who
  genuinely needs them gets the safe version.
• Pins said v1.0.0 while v1.0.3 is current, and the "verify against the
  checksum published on the release page" instruction had no checksum to
  point at. The sha256 is now inline next to the curl.
• The example config was .ptc/config.yml; ptc init writes .ptc-config.yml
  at the repository root, which is also the path the action auto-detects.
• The GitLab job did chmod +x ptc-cli.sh on a file it never downloaded, had
  no image (so no bash on a default Alpine runner), never pushed anything, and
  gated on the deprecated only:. Replaced with the job ptc init prints,
  including the PTC_GIT_PUSH_TOKEN fallback and the [skip ci] guard, plus the
  note that a Catalog component can never resolve cross-instance.

No behaviour change; 180 tests still green (12 + 72 + 22 + 22 + 52).