feat(workflows): add stale pull request lifecycle

[szmyty]

Outcome

Adds a reusable, advisory-first stale pull-request lifecycle without copying repository-specific YAML or permitting silent first-run closure.

What changed

• adds the stale-pull-requests composite action and reusable workflow
• parameterizes inactivity/warning windows, managed labels, users/teams, drafts, bots, issue opt-in, closure, messages, and bounded run size
• separates read-only planning from checksum-bound apply jobs
• keeps PR-only callers free of Issues permission; issue-enabled callers use separate, explicitly scoped jobs
• requires an exact repository-Actions warning marker, stale label, unchanged activity/head evidence, and a completed warning window before closure
• adds reopen/activity recovery, safe partial-warning repair, bounded summaries, immutable dependencies, examples, catalogs, changelog, and contract documentation
• reconciles stale architecture/system inventory wording without changing roadmap state

Safety contract

• advisory mode and close-enabled: false are the defaults
• issue processing is disabled unless process-issues: true
• draft, bot-authored, dependency/security, pinned, critical, and explicitly exempt work is protected by default
• plans are body-redacted, SHA-256 bound, and revalidated against live provider state before every write
• PR-only live reads use the Pull Requests API; issue mode is separately permissioned
• provider scans are bounded, duplicate-free, identity-stable across two passes, and fail closed on incomplete issue-search evidence
• apply is confined to the target repository's default branch and never deletes branches or checks out consumer code
• custom text cannot hide Relay's fixed visible warning; symlinked workspace paths are rejected
• multi-item provider writes are explicitly non-transactional and recovery behavior is documented

Validation

• python3 scripts/validate_actions.py
  • 10 actions, 17 workflows, 12 reusable workflows
• python3 scripts/validate_continuity_preflight_contract.py validate
• python3 -m unittest discover --start-directory tests --pattern "test_*.py"
  • 333 tests passed
• 50 focused lifecycle/catalog tests passed
• python3 -m compileall -q actions scripts tests
• JSON/YAML parsing and inline Bash syntax validation
• git diff --check
• independent code, security, and contract reviews: no remaining blocker, major, or minor findings

Governance

• Roadmap-Step: none
• Roadmap impact: evidence reconciled; no state transition
• ADR impact: none; this operationalizes ADR-001, ADR-002, ADR-003, ADR-005, and ADR-006
• no release declaration, tag, or moving alias is changed here

This advances the implementation, but publication remains a separate v1.6.0 / v1 release gate. Keep #14 open until that immutable release evidence exists.

Advances #14

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 15⭐
  Check Your Progress