feat: add stale PR dry-run caller

## Summary

Adds a scheduled/manual, read-only stale pull-request candidate report.
It pins `makeitworkcloud/shared-workflows` to
`e7560bb511468fd800aedbc783d02950d3dff5ca`, passes `dry-run: true`, and
grants only `contents: read` and `pull-requests: read`.

Fixes #
N/A — approved organization-wide dry-run rollout.

## Type of change

- [x] CI / reusable workflow

## Validation

- [ ] Required pull-request checks pass — pending after PR creation. The
caller intentionally runs only on schedule or manual dispatch.
- [x] Generated or centrally distributed files were regenerated by their
owning automation, not hand-edited — N/A; temporary repository-local
adoption pending centralized ownership implementation.

## Impact and rollout

No live mutation is possible in this phase. This PR does not modify
centralized repository-file distribution; a later separately reviewed
OpenTofu change will own organization-wide caller distribution. After a
separately confirmed merge, a default-branch run must verify
reusable-workflow resolution and candidate-only output before any
live-mode proposal. No `.tf` changes; plan should be a no-op.

**Owner waiver (2026-09-09):** approved opening despite the intentional
pre-merge resolution gap. This approval does **not** authorize merging
or workflow dispatch; a separate explicit merge confirmation remains
required.

Rollback: remove `.github/workflows/stale-pull-requests.yml`.

## Safety and secrets

- [x] Contains no plaintext secrets, decrypted SOPS values, state files,
kubeconfigs, tokens, or private endpoints
- [x] No local OpenTofu init/plan/apply/destroy/import/state operations
were run or claimed — plans come from pull-request checks
- [x] Breaking or irreversible effects are described above with rollback
notes

AI-assisted change; review the full workflow diff and pinned producer
contract.

Author: xnoto

.github/workflows/stale-pull-requests.yml

@@ -0,0 +1,19 @@
+---
+# Temporary repository-local dry-run caller. Organization-wide adoption remains
+# owned by tfroot-github after branch-protection-compatible adoption.
+name: stale-pull-requests
+
+on:
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  stale:
+    uses: makeitworkcloud/shared-workflows/.github/workflows/_stale-pull-requests.yml@e7560bb511468fd800aedbc783d02950d3dff5ca
+    with:
+      dry-run: true