ci: add stale-branch audit workflow

[drunkcoding]

Description

Adds a scheduled Stale Branches workflow (.github/workflows/stale-branches.yml + .github/workflows/scripts/scan-stale-branches.sh) that audits remote branches against the default branch and reports which are merged (safe to delete) vs. dead/stale. Companion to #302 (docs/branch-maintenance.md), which documents the same classification method.

Motivation

PR_MERGE_POLICY.md §4 requires "delete the PR branch once merged," but there is no automation enforcing it, so merged branches accumulate. This adds a low-risk, report-first job to surface them continuously.

Type of Change

• infra — build / CI / packaging / scripts / Docker

File changes

File	Δ	Note
.github/workflows/stale-branches.yml	add	Weekly schedule + manual dispatch; report-only by default
.github/workflows/scripts/scan-stale-branches.sh	add	Classify (linear/squash/unmerged) + age scan; opt-in merged-only deletion

Safety model

• Scheduled runs are always report-only — results go to the job summary; the script hard-forces report mode on schedule events regardless of inputs.
• Deletion is opt-in and gated: manual workflow_dispatch with mode=delete-merged and confirm=DELETE.
• Only provably-merged branches are ever deleted — linear (ancestor of the default branch) or single-commit squash (git cherry patch-id). Multi-commit squash is report-only (manual review).
• Never deleted: unmerged, dead, stale, protected (main/master/release/*/release-*/hotfix/*), or branches with an open PR.
• Squash detection = synthetic full-tree commit + git cherry (equivalent to git-delete-merged-branches --effort=3); same method as docs: branch audit + cleanup plan (linear vs squash, dead-branch scan) #302.

Validated locally in report mode (linear=7, squash1=51, squashN=44, dead=12, stale=24, active=37) and confirmed a delete-merged+confirm=DELETE request on a schedule event performs no deletion.

Checklist

• I have read the CONTRIBUTING guide and the PR Merge Policy Contract.
• I have updated the tests (if applicable). — n/a (CI workflow)
• I have updated the documentation (if applicable). — complements docs: branch audit + cleanup plan (linear vs squash, dead-branch scan) #302

PR Merge Policy Contract — pre-merge checklist

• git diff --stat origin/main reviewed; only the two intended files — no unrelated files.
• Exactly one Type of Change (infra) ticked; both files are within the infra set (CI / scripts).
• File changes table matches the diff.
• No debug_*/check_*/scratch_*/tmp_* scripts added to a production package or repo root (the script lives under .github/workflows/scripts/).
• No test_*.py added inside the runtime package.
• No new BATCHGEN_* env-var debug guard.
• No leftover print() or commented-out code in the changed files.
• No logs, traces, CSVs, checkpoints, wheels, or compiled artifacts staged; nothing added with -f.
• No public API change → no MODULE.md update needed.
• One concern only; diff is surgical (a workflow + the script it invokes).
• Commits are clean: Angular format, body present, no Co-Authored-By.
• CI is green (format, lint, hygiene, tests). — pending CI