ci: track meaningful pull request inactivity

Use human activity and observed head changes because GitHub can update PR timestamps without contributor activity.

Audit every open PR before applying changes and start existing PRs from a safe baseline.

.github/workflows/stale-prs.yml

@@ -0,0 +1,41 @@
+name: Stale Pull Requests
+
+on:
+  schedule:
+    - cron: "30 3 * * *"
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: Run without changes or apply the PR inactivity policy
+        type: choice
+        required: true
+        default: dry-run
+        options:
+          - dry-run
+          - apply
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: stale-pull-requests
+  cancel-in-progress: false
+
+jobs:
+  stale-prs:
+    name: Check Every Open PR
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+      - name: Check PR inactivity
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          RUN_MODE: ${{ github.event_name == 'schedule' && 'apply' || inputs.mode }}
+        run: node scripts/stale-prs/run.mjs "--${RUN_MODE}"

.github/workflows/stale.yml

@@ -1,4 +1,4 @@
-name: Stale Issues and PRs
+name: Stale Issues
 
 on:
   schedule:
@@ -7,11 +7,11 @@ on:
 
 permissions:
   issues: write
-  pull-requests: write
+  pull-requests: read
 
 jobs:
   stale:
-    name: Mark and Close Stale
+    name: Mark and Close Stale Issues
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
@@ -19,22 +19,15 @@ jobs:
         with:
           days-before-issue-stale: 60
           days-before-issue-close: 14
-          days-before-pr-stale: 30
-          days-before-pr-close: 14
+          days-before-pr-stale: -1
+          days-before-pr-close: -1
           stale-issue-label: stale
           stale-pr-label: stale
+          remove-pr-stale-when-updated: false
           exempt-issue-labels: "pinned,security"
-          exempt-pr-labels: pinned
           stale-issue-message: >
             This issue has been inactive for 60 days. It will be closed in 14 days
             unless there is new activity. If this is still relevant, please leave a
             comment or update the issue.
-          stale-pr-message: >
-            This PR has been inactive for 30 days. It will be closed in 14 days
-            unless there is new activity. If you are still working on this, please
-            leave a comment or push an update.
           close-issue-message: >
             Closing due to inactivity. Feel free to reopen if this is still relevant.
-          close-pr-message: >
-            Closing due to inactivity. Feel free to reopen if you want to continue
-            this work.