The issue-implementer workflow fails when its PR touches protected files (like ci.yml). Instead of failing, it should fall back to creating a review issue with the proposed changes.
Add protected-files: fallback-to-issue to the create-pull-request safe output in issue-implementer.md.