feat: add stale PR dry-run caller

[xnoto]

Summary

Adds a scheduled/manual, read-only stale pull-request candidate report. It pins makeitworkcloud/shared-workflows to e7560bb511468fd800aedbc783d02950d3dff5ca, passes dry-run: true, and grants only contents: read and pull-requests: read.

Fixes #
N/A — approved organization-wide dry-run rollout.

Type of change

• CI / reusable workflow

Validation

• Required pull-request checks pass — pending after PR creation. The caller intentionally runs only on schedule or manual dispatch.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — N/A; temporary repository-local adoption pending tfroot-github distribution.

Impact and rollout

No live mutation is possible in this phase. After a separately confirmed merge, a default-branch run must verify reusable-workflow resolution and candidate-only output before any live-mode proposal. No OpenTofu, GitOps, image, or chart artifact changes.

Owner waiver (2026-09-09): approved opening despite the intentional pre-merge resolution gap. This approval does not authorize merging or workflow dispatch; a separate explicit merge confirmation remains required.

Rollback: remove .github/workflows/stale-pull-requests.yml.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI-assisted change; review the full workflow diff and pinned producer contract.