feat: add stale PR dry-run caller

[xnoto]

Summary

Adds a scheduled and manually dispatchable, read-only stale pull-request candidate report. The caller pins the reusable workflow to e7560bb511468fd800aedbc783d02950d3dff5ca, supplies dry-run: true, and grants only contents: read and pull-requests: read.

Fixes #
N/A — approved organization-wide dry-run rollout.

Type of change

• CI / reusable workflow

Validation

• Required pull-request checks pass — pending after PR creation. This caller intentionally runs only on schedule or manual dispatch.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — N/A; branch-protection-compatible repository-local adoption is temporary pending tfroot-github distribution.

Impact and rollout

No live mutation is possible in this phase. After a separately confirmed merge, the next scheduled run or a separately confirmed manual dispatch must verify reusable-workflow resolution and candidate-only output before any live-mode proposal. No OpenTofu, GitOps, image, or chart artifact changes.

Owner waiver (2026-09-09): approved opening this PR despite the intentional pre-merge resolution gap; GitHub can resolve a schedule/manual reusable caller only after it is on the default branch. This approval does not authorize merging or workflow dispatch. For repositories with an unprotected main, it also waives the protection assumption for review purposes only; a separate explicit merge confirmation remains required.

Rollback: remove .github/workflows/stale-pull-requests.yml.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI-assisted change; review the full workflow diff and pinned producer contract.

[github-actions]

Image CI passed

Pre-commit validation passed. View the workflow run.