feat: add stale PR dry-run caller

[xnoto]

Summary

Adds a scheduled/manual, read-only stale pull-request candidate report. It pins makeitworkcloud/shared-workflows to e7560bb511468fd800aedbc783d02950d3dff5ca, passes dry-run: true, and grants only contents: read and pull-requests: read.

Fixes #
N/A — approved organization-wide dry-run rollout.

Type of change

• CI / reusable workflow

Validation

• Required pull-request checks pass — pending after PR creation. The caller intentionally runs only on schedule or manual dispatch.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — N/A; temporary repository-local adoption pending centralized ownership implementation.

Impact and rollout

No live mutation is possible in this phase. This PR does not modify centralized repository-file distribution; a later separately reviewed OpenTofu change will own organization-wide caller distribution. After a separately confirmed merge, a default-branch run must verify reusable-workflow resolution and candidate-only output before any live-mode proposal. No .tf changes; plan should be a no-op.

Owner waiver (2026-09-09): approved opening despite the intentional pre-merge resolution gap. This approval does not authorize merging or workflow dispatch; a separate explicit merge confirmation remains required.

Rollback: remove .github/workflows/stale-pull-requests.yml.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI-assisted change; review the full workflow diff and pinned producer contract.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and
--
No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and