feat: add dry-run stale PR lifecycle workflow

[xnoto]

Summary

Adds _stale-pull-requests.yml, a reusable, dry-run-first workflow for the approved PR lifecycle policy. In live mode it closes eligible PRs whose pullRequest.updated_at is at least 30 days old, then deletes only an eligible same-repository head branch that GitHub can restore from the closed PR.

Fixes #

None.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — pending lint.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated consumer file is changed; this is the reusable-workflow producer.
• Adversarial review found no remaining Critical or High findings after branch-closure and branch-deletion safeguards were corrected.
• Infrastructure-security review found no Critical or High findings.
• QA review confirms existing CI provides static workflow validation only; a reviewed dry-run: true consumer pilot remains required before live mode.
• GitHub Advanced Security secret scanning is unavailable for this repository; reviewer inspection found no secrets.

Impact and rollout

Producer: shared-workflows owns the new _stale-pull-requests.yml reusable workflow and its GitHub Script action pin.

Consumer: no repository calls this workflow yet. A later tfroot-github change must own the scheduled caller at .github/workflows/stale-pull-requests.yml; existing protected repositories require their own bootstrap PRs.

Behavior: the caller receives no secrets and must grant contents: write and pull-requests: write. dry-run defaults to true. Live mode excludes drafts, assigned and milestoned PRs, and PRs labeled do-not-close, blocked, or security. It checks head/base references, default-branch status, protection, and same-repository ownership before deletion. Fork head branches are not deleted.

Delivery stages: authored and submitted. PR lint is pending. Merge is a separate confirmation gate. After merge, the producer is callable but inert until a reviewed consumer dry-run caller is merged. Enabling live mode, closing PRs, deleting branches, and any tfroot-github apply remain separate confirmation-gated operations.

Rollback: do not add a caller, or remove/disable its caller before live mode. A mistakenly closed PR can be reopened; GitHub's closed-PR Restore branch path is the intended branch recovery mechanism.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI-assisted change: an OpenCode agent authored the reusable workflow after the owner approved the 30-day policy. It is dry-run-first and does not activate any consumer repository.

[github-actions]

Shared Workflows CI

Shared workflows CI passed.

View the workflow run.

View run output

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/rhysd/actionlint.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/rhysd/actionlint.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
Detect hardcoded secrets.................................................Passed
Lint GitHub Actions workflow files.......................................Passed