A **minor**: one new template and one new package in the `ci` image. No existing input changes. - **`github-release`** publishes each GitLab release to the repo's GitHub push mirror on tag pipelines. It mints a one-hour, one-repo token from the dunn-releases App, which needs the protected group variables `GITHUB_RELEASE_APP_ID` and `GITHUB_RELEASE_APP_KEY_B64`. Notes come from the GitLab release, and asset links point back to GitLab. A re-run is idempotent and backfills older releases GitHub is missing. Input: `github_repo` (owner must be `andrewdunndev`), plus `dry_run` and `poll_timeout`. - **`ci` ships `openssl`**, which the `github-release` job uses to sign its token request.