ci(1979): call the board-aware stale sweep instead of copying actions/stale

[LukasWodka]

Part of the backend#1979 wave. backend#1680 closes on this landing.

What changes

.github/workflows/stale-backlog.yml — a byte-identical copy of an actions/stale
config carried in 16 repos — becomes a thin caller of the reusable that .github#288
landed, following the -caller.yml convention already used by fr-gate-caller.yml,
code-quality-caller.yml and fr-pass-comment-caller.yml.

jobs:
  stale:
    uses: tracebloc/.github/.github/workflows/stale-backlog.yml@main
    secrets: inherit

Why it is not just deduplication

The copy called actions/stale, which is column-blind: it can see labels and
dates, not the board. So it would close a North Stars epic, or anything already in
the pipeline, on the same 6-week/8-week timer as a forgotten Backlog item — the
defect behind backend#1597 item 1.

Board awareness needs a script, and a script cannot be maintained as sixteen
byte-identical copies. The reusable's eligibility is exactly Backlog, and it
fails toward skipping, because the destructive direction here is closing.

No inputs passed, on purpose

Every input the callee declares is defaulted (project-number: 2, dry-run: false,
strict: false, script-ref: main). A caller may only pass inputs the @main
callee declares — passing one it lacks kills the run at startup_failure, which is
exactly why the callee had to reach main before any caller could be armed.

permissions: contents: read only: the sweep's writes go through the App token
minted inside the reusable, and asking for more here than the callee needs fails the
run at startup with no jobs.

DRAFT — and what un-drafts it

This cannot merge yet, and draft is the mechanical guarantee of that. Callers pin
@main, and .github/main still carries the old 1174-byte copy — the reusable is on
.github/develop, 4 commits ahead. Merging this first would leave a scheduled
workflow that fails at startup every Monday.

Order, per the note carried in repo-inventory.yml:

1. .github promotes develop → staging → main, carrying the reusable
2. these 16 callers merge
3. one final .github PR adds .github's own caller and flips all 17 inventory
   entries from exempt to required

Step 3 is last for a stated reason: flipping to required before a repo's caller
lands would redden the org audit for every repo still waiting — the drift window made
to look permanent. And .github's caller ships with the flip rather than before it,
because exempt plus a caller on the audited branch is itself a finding
(caller-drift.py:2260).

🤖 Generated with Claude Code