ci: synchronize pull request review and stale automation

[Oxxyg33n]

Summary

PRs in this repository need consistent review status and inactivity handling. Install the custom labeler from wallester/monorepo at 42aff24cf293, with event-driven, daily, and manual refresh for existing open PRs.

Review labels distinguish waiting for review, waiting for final review, changes required, and ready for merge. Drafts have review labels removed. The configured threshold is 2 approvals, based on this repository's inspected default-branch protection and rulesets; GitHub's live review decision remains an additional gate. The action pins GitHub Script, clears obsolete review labels, and skips PRs closed while a refresh was queued.

Adds stale-PR handling. After merge, PRs (including drafts) are marked stale after 7 inactive days and closed after 7 further days. keep-open exempts a PR; activity resets the timer; branches are preserved. Required labels are created by the workflow. Manual stale runs default to a non-mutating dry run.

Validation

• node --test github-actions/pr-review-labeler/action.test.cjs: 32 scenarios passed, covering review decisions, reviewer permissions, current-head approvals, dismissals, drafts, legacy labels, queued closures, target selection, and stale-label dry runs.
• actionlint v1.7.12: all three workflow files passed.
• Full generated diff reviewed against the recorded default branch; unrelated repository files are preserved.
• Automation scope: not applicable — GitHub PR maintenance only; no deployed service or release pipeline behavior changes. Unit scenarios added: 32; changed: 0; deleted: 0. Coverage percentage not measured because this composite action has no existing coverage harness.
• GitHub execution against the trusted default-branch action can be verified after merge. The install PR skips label writes until the action exists on the default branch. The added validation workflow runs the tests with read-only permissions.

Rollout and rollback

Merge to enable this repository's workflows; no default branch, branch protection, merge, or existing PR closure is performed by this draft PR. Daily/manual review refresh backfills existing PRs. Fork/Dependabot review events are reconciled by daily/manual runs because their review-event tokens are read-only. Review labels are advisory; checks, conflicts, code owners, and branch protection still control merging.

Disable the workflow or revert this commit to stop it. Existing labels persist; closed PRs can be reopened manually. The initial label backfill may update PR activity once; unchanged labels are not rewritten. The daily refresh supports up to 256 open PRs per repository through a GitHub job matrix (current inventory maximum: 60).

[Oxxyg33n]

@Oxxyg3n Test delta for this PR:

• Unit tests: added 32, changed 0, deleted 0 (each table entry is one scenario).
• Automation tests: not applicable — GitHub PR-maintenance workflows only.
• Coverage impact: not measured; the copied composite action has no existing coverage harness.
• Local verification: node --test github-actions/pr-review-labeler/action.test.cjs → 32 passed; actionlint → all three workflows passed.
• Local Automation verification: not applicable — no deployed service or release-pipeline behavior changes.
• Automation test gap: not applicable.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T09:42:34.853933Z	c3ed0ee	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.