feat: add stale PR dry-run pilot

[xnoto]

Summary

Adds a temporary repository-local scheduled caller for the stale-PR workflow with dry-run: true. It is a no-mutation pilot that reports eligible candidates in Actions logs and does not activate the organization-wide rollout.

Fixes #

None.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — pending lint.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — this temporary pilot is intentionally repository-local; no centrally generated caller exists yet.
• Infrastructure-security review initially found overbroad write permissions; the caller now grants only contents: read and pull-requests: read. Final review found no Critical or High findings.
• The pilot is hard-coded dry-run: true; it has no dispatch input, secrets, close API permission, or branch-delete permission.

Impact and rollout

Producer: _stale-pull-requests.yml is selected by immutable commit SHA.

Consumer: this repository only, as a temporary dry-run pilot. The eventual organization-wide caller remains owned by tfroot-github; it is not authored or distributed here.

Delivery stages: authored and submitted. lint is pending. After merge, the schedule and manual dispatch can report eligible PRs only. Reviewing the resulting log is a manual gate before a broader dry-run expansion. A live caller, PR closure, branch deletion, OpenTofu adoption, and any GitHub Actions dispatch are separate confirmation-gated operations.

Rollback: remove or disable this caller through a reviewed PR. Because the caller token is read-only and dry-run is fixed true, no PR or branch restoration is needed.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI-assisted change: owner-approved dry-run pilot. It cannot mutate repository state.

[github-actions]

Shared Workflows CI

Shared workflows CI passed.

View the workflow run.

View run output

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/rhysd/actionlint.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/rhysd/actionlint.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
Detect hardcoded secrets.................................................Passed
Lint GitHub Actions workflow files.......................................Passed