chore: add stale branch cleanup workflow

Org-wide rollout to keep repositories clean.

- Branches matching feature/*, fix/*, release/* marked stale after
  30 days, deleted after 7 more days. Open PRs always protected.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: tparnell

.github/workflows/stale-branches.yml

@@ -0,0 +1,30 @@
+# Marks stale, then deletes, stale branches. See:
+# https://github.com/marketplace/actions/remove-stale-branches
+#
+# Part of an org-wide rollout. Timing is staggered across repos
+# to avoid GitHub API rate limits (9:00-9:59 AM ET window).
+
+name: 'Stale Branches'
+on:
+  schedule:
+    # Runs at 9:04 AM Eastern, Monday-Friday (14:04 UTC)
+    - cron: '4 14 * * 1-5'
+  workflow_dispatch: # Allow manual trigger
+
+permissions:
+  contents: write
+  pull-requests: read
+
+jobs:
+  remove-stale-branches:
+    name: Stale Branches
+    runs-on: ubuntu-latest
+    steps:
+      - uses: fpicalausa/remove-stale-branches@v2.4.0
+        with:
+          days-before-branch-stale: 30
+          days-before-branch-delete: 7
+          # Only target conventional branch prefixes
+          restrict-branches-regex: '^(feature|fix|release)/'
+          ignore-branches-with-open-prs: true
+          operations-per-run: 100