feat: add dry-run stale PR lifecycle workflow

[xnoto]

Summary

Supersedes #43, whose branch could not be updated because of a README conflict after main advanced. Adds _stale-pull-requests.yml, a dry-run-first reusable workflow for the approved 30-day inactive-PR policy.

Fixes #

None.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — pending lint on this rebased PR.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — this is the reusable-workflow producer; no consumer file changes.
• The final implementation was adversarially and infrastructure-security reviewed with no Critical or High findings. The rebased branch retains the reviewed workflow logic and incorporates current main README guidance.
• QA confirmed static CI does not execute destructive behavior; a reviewed dry-run: true consumer pilot remains mandatory before live mode.

Impact and rollout

Producer: shared-workflows owns _stale-pull-requests.yml. It uses only a full-SHA-pinned GitHub Script action.

Consumer: none yet. A later tfroot-github-owned caller and repository-local bootstrap PRs are required. This merge makes the producer callable but does not schedule, close, or delete anything.

Behavior: dry-run defaults to true. Live mode closes non-draft, unassigned, unmilestoned PRs with pullRequest.updated_at at least 30 days old, excluding do-not-close, blocked, and security. It deletes only eligible, same-repository, unprotected non-default branches after verified closure and head/base reference checks; fork heads are skipped.

Delivery stages: authored and submitted. lint is pending. Merge is confirmation-gated. Consumer selection, dry-run pilot, live-mode enablement, PR closure, branch deletion, and any OpenTofu apply are all separate gates.

Rollback: do not add a caller, or remove/disable it before live mode. A mistakenly closed PR can be reopened and GitHub's Restore branch path is the intended branch recovery method.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI-assisted change: owner-approved implementation, dry-run by default. No consumer is activated by this PR.

[github-actions]

Shared Workflows CI

Shared workflows CI passed.

View the workflow run.

View run output

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/rhysd/actionlint.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/rhysd/actionlint.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
Detect hardcoded secrets.................................................Passed
Lint GitHub Actions workflow files.......................................Passed