ci(1979): land .github's own stale-sweep caller, ahead of the flip

[LukasWodka]

The 17th and last caller of the backend#1979 wave. Split out of #293 so that PR can go green — it currently cannot, and not for a reason a re-run fixes.

Why this is a separate PR

The audit reads caller presence from a repo's audited branch via the API; --source-dir covers only copies and reusables. So for .github itself, the caller does not exist on develop until it merges.

#293 bundles this file with the exempt → required flip. With the entry flipped and the caller not yet on develop, its own audit reports:

1 drift finding(s):
- .github: MISSING required caller for stale-backlog.yml on develop.

Measured on #293, run 32595845377 — a fresh run at 20:09, after all 16 other callers had merged. That is the whole remaining finding: the flip cleared the other 16, and this one cannot clear, because gate is a required context, so the PR that adds the caller cannot merge until the caller is added. A deadlock, not a flake.

Splitting also restores the rule repo-inventory.yml's own header states, and which the wave followed for all 16 other repos: land the caller first, flip the entry after.

The comment this file used to carry, and why it changed

The version in #293 said the caller lands in the same PR as the flip "deliberately", because exempt plus a caller on the audited branch is itself a finding (caller-drift.py:2260).

That finding is real — it is exactly what .github's audit will report between this PR merging and #293 merging. But it is a transient window closed by the very next merge, and the alternative it was avoiding is not a smaller window: it is a PR that can never go green. The same transient window was accepted fleet-wide for the other 16 repos, bounded by the stale_backlog_migration_in_flight anchor.

I rewrote the header rather than leaving a comment that describes a plan no longer being followed — a stale rationale is the failure mode this repo files tickets about.

What it does

Calls the board-aware reusable on @main. No inputs passed, on purpose: every input the callee declares is defaulted (project-number: 2, dry-run: false, strict: false, script-ref: main), and a caller may only pass inputs the callee declares — passing one it lacks kills the run at startup_failure.

Verification

• python3 -c "import yaml..." parses; actionlint clean.
• No contract file touched, so conformance-gate correctly does not demand the audit for this PR (GUARDED lists repo-inventory.yml, caller-drift.py, its selftest, caller-drift.yml and conformance-gate.yml — none of them here).

Merge order

1. this PR → .github's caller is on develop; the org audit shows one transient exempt-with-caller finding for .github
2. ci(1979): arm the stale sweep — .github joins the wave, and the flip lands last #293 → flips all 17 entries to required, deletes the migration anchor; its audit should then be green, since every one of the 17 callers now exists
3. .github#306 unblocks as collateral, and backend#1979 closes

---

Note

Low Risk
CI-only thin caller with read-only GITHUB_TOKEN; issue closes go through the existing reusable and App token. Transient audit drift until the follow-up flip lands.

Overview
Adds the last thin caller for the org stale-backlog sweep so this repo can invoke stale-backlog.yml@main on Mondays (and via workflow_dispatch).

The caller is split from the exempt → required inventory flip so the audit can see the file on develop before the entry is required—bundling both would deadlock because gate is a required check. No inputs are passed; defaults live on the reusable. Permissions stay contents: read; writes use the App token inside the callee.

^{Reviewed by Cursor Bugbot for commit cc8b94c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit cc8b94c. Configure here.}

[saadqbal]

Approving. Two things checked rather than taken:

The caller is byte-identical to the wave. I diffed the non-comment body against the one I approved on start-training#66 / e2e-test-agent#182 / docs#131 / claude-skills#31 — identical. That's the whole value of the thin-caller shape, and it holds for the 17th as it did for the first sixteen.

The deadlock is real, and I read it in the log rather than believing the paragraph. .github#293's audit run fails with exactly:

1 drift finding(s):
- .github: MISSING required caller for stale-backlog.yml on develop.

and its gate then fails with caller-drift.yml concluded 'failure' ... A contract change must not merge on a failed or skipped audit. So the cycle is exactly as described: gate is required, gate needs the audit green, the audit needs the caller present on develop, and the only way the caller reaches develop is this merge. Bundling the flip with the caller is a PR that cannot go green, ever — not a smaller window.

The rewritten comment is the right call for the right reason, too. The earlier version wasn't wrong about exempt + a caller on the audited branch being its own finding — it is, and this repo's audit will be red between this merge and #293 — but a transient window closed by the next merge beats a permanent one, and splitting restores the ordering the other sixteen repos already followed. Naming the superseded reasoning instead of quietly deleting it is what let me check the trade-off rather than re-derive it.

One consequence worth stating for whoever picks up #293: it is red because this hasn't merged, so it should be re-run rather than debugged once this lands. I've said as much over there.

[LukasWodka]

/fr-pass