feat: add stale PR dry-run caller

[xnoto]

Summary

Adds a scheduled/manual, read-only stale pull-request candidate report. It pins the reusable producer to e7560bb511468fd800aedbc783d02950d3dff5ca, passes dry-run: true, grants only read permissions, and includes the required reader-ready Unreleased changelog entry.

Fixes #
N/A — approved organization-wide dry-run rollout.

Type of change

• CI / reusable workflow

Documentation and changelog

• CHANGELOG.md updated with a reader-ready, user-facing note under ## Unreleased (CI fails pull requests that do not change the changelog)
• N/A — no pyproject.toml version change

Validation

• Required pull-request checks pass — pending after PR creation. The caller intentionally runs only on schedule or manual dispatch.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — N/A; temporary repository-local adoption pending tfroot-github distribution.

Impact and rollout

No NetworkManager, Cloudflare DNS, OpenTofu, GitOps, image, or chart artifact changes. After a separately confirmed merge, the next scheduled run or separately confirmed manual dispatch must verify reusable-workflow resolution and candidate-only output before any live-mode proposal.

Owner waiver (2026-09-09): approved opening despite the intentional pre-merge resolution gap. This approval does not authorize merging or workflow dispatch. A separate explicit merge confirmation remains required.

Rollback: remove .github/workflows/stale-pull-requests.yml.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI-assisted change; review the full workflow diff and pinned producer contract.