Fix module cleanup workflow

[trask]

Several fixes to the module cleanup workflow:

• Split finalization and self-dispatch tokens (the original change): finalize uses the app token so the PR runs workflows; self-dispatch uses the default GitHub Actions token.
• Stop checking out / fetching shallowly in the finalize job. With fetch-depth: 1 plus git fetch origin main --depth=1, origin/main was grafted, so origin/main..origin/module-cleanup-wip log/diff included main's own ancestors that happened to be reachable from wip's recently-fetched history. That made the batch PR title and "Modules in this batch" section list ~50 merged-main PRs instead of the actual cleanup commits, and (because the dispatch step scraped those backticked lines from open module-cleanup PR bodies into the "already processed" set) it poisoned the queue, dropped queue_remaining to 0, and triggered the queue-exhausted flush branch — bypassing the 10-file FLUSH_THRESHOLD. See Module cleanup: batch of modules (run 25590902041) #18654 for the resulting bad PR.
• Drop the inflight-PR-body parser from the dispatch step entirely. processed.txt on the memory branch is now the sole source of truth for the "already processed" set, with inflight modules derived from cleanup commit subjects on the wip branch — so a malformed PR body can no longer poison the processed set.
• Rename the wip branch to otelbot/module-cleanup-wip to match other otelbot-owned branches.
• Update the AWF sandbox comments to point to Sandboxed Copilot workflows should set responses wire API for GPT-5 models in BYOK/offline mode github/gh-aw#31241.

[Copilot]

Pull request overview

This PR fixes reliability issues in the automated module-cleanup workflow by separating credentials for PR creation vs workflow self-dispatch, eliminating shallow-history pitfalls in the finalize job, and hardening how inflight PR bodies are parsed to compute the “already processed” set.

Changes:

• Split tokens so PR creation/push uses the GitHub App token (to ensure downstream workflows run), while workflow self-dispatch uses the default GITHUB_TOKEN.
• Stop using shallow history in finalize (checkout fetch-depth: 0; remove depth-limited git fetch in finalize.sh) to prevent incorrect origin/main..origin/module-cleanup-wip ranges.
• Restrict inflight PR parsing to the ## Modules in this batch section terminated by --- to reduce the chance of processed-set poisoning from unrelated backticked lines.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/module-cleanup.md	Updates module-cleanup workflow logic: token split, full-history checkout in finalize, and tighter inflight PR body parsing.
.github/workflows/module-cleanup.lock.yml	Regenerated locked workflow reflecting the same functional changes (token split, full-history checkout, parsing hardening).
.github/scripts/module-cleanup/finalize.sh	Removes self-dispatch, avoids depth-limited fetches, and relies on full repo history for accurate diff/log computation.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.