feat: branch-triage GH Action + weekly workflow (#209)

Adds .github/actions/branch-triage/ — a composite action that classifies,
rebases, merges, and prunes branches:

- triage.sh: classifies remote branches into OPEN / MERGED / SUPERSEDED /
  REVIEW, deletes MERGED+SUPERSEDED, rebases+merges OPEN PRs one at a time,
  skips REVIEW branches with a report
- action.yml: composite action wrapping triage.sh with inputs for
  base-branch, merge-strategy, dry-run, stale-days, github-token
- README.md: usage, inputs/outputs, conflict-resolution policy
- .github/workflows/branch-triage.yml: example workflow — scheduled Monday
  09:00 UTC + manual workflow_dispatch with dry-run toggle

Conflict resolution: files not owned by the branch take base's version
automatically; files owned by the branch abort the rebase with a warning
so security/logic changes are never silently dropped.

Closes #196

Author: BunsDev

.github/actions/branch-triage/README.md

@@ -0,0 +1,83 @@
+# branch-triage action
+
+Composite GitHub Action that classifies, rebases, merges, and prunes
+branches in a repository. Designed for repos that accumulate many
+short-lived feature branches and need periodic cleanup.
+
+## What it does
+
+1. **Classifies** every remote branch into one of four categories:
+
+   | Category | Definition | Action |
+   |---|---|---|
+   | OPEN | Has an open PR | Rebase onto base + merge |
+   | MERGED | Has a merged PR | Delete local + remote |
+   | SUPERSEDED | No PR, 0 unique commits vs base | Delete |
+   | REVIEW | No PR, >0 unique commits | Skip — report only |
+
+2. **Deletes** MERGED and SUPERSEDED branches (remote + local).
+3. **Rebases** each OPEN-PR branch onto the base, then merges the PR.
+4. **Skips** REVIEW branches — reports them in the job summary so a human can decide.
+5. **Writes** a Markdown summary to the GitHub job summary.
+
+## Inputs
+
+| Input | Required | Default | Description |
+|---|---|---|---|
+| `base-branch` | no | `main` | Protected base branch |
+| `merge-strategy` | no | `squash` | `squash`, `merge`, or `rebase` |
+| `dry-run` | no | `false` | Classify only; no deletes or merges |
+| `stale-days` | no | `30` | Zero-commit branches older than this are SUPERSEDED (0 = off) |
+| `github-token` | no | `${{ github.token }}` | Token with repo write + PR write |
+
+## Outputs
+
+| Output | Description |
+|---|---|
+| `merged-count` | PRs merged |
+| `deleted-count` | Branches deleted |
+| `kept-count` | REVIEW branches left untouched |
+
+## Usage
+
+```yaml
+# Scheduled weekly + manual dispatch
+on:
+  schedule:
+    - cron: "0 9 * * 1"   # every Monday 09:00 UTC
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        default: "false"
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  triage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/branch-triage
+        with:
+          dry-run: ${{ inputs.dry-run || 'false' }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+```
+
+## Conflict resolution policy
+
+When rebasing an OPEN-PR branch:
+- Files **not owned by the branch** (not in its diff vs base) → take base version automatically.
+- Files **owned by the branch** → rebase is aborted and the PR is skipped with a warning; resolve manually.
+
+This avoids silently dropping logic or security changes the branch intentionally introduces.
+
+## Relationship to Coven skill
+
+The same workflow is available as an internal OpenCoven familiar skill at
+`~/.coven/skills/git-branch-triage/SKILL.md`. The skill version is
+interactive (asks before destructive actions); this Action version is
+automated and runs headless on a schedule.

.github/actions/branch-triage/action.yml

@@ -0,0 +1,66 @@
+name: Branch Triage
+description: >
+  Classify, rebase, merge, and prune git branches.
+  Merges open PRs, deletes merged/superseded branches, removes orphaned
+  worktrees, and writes a Markdown summary to the job summary.
+
+inputs:
+  base-branch:
+    description: The protected base branch to measure all others against.
+    required: false
+    default: main
+  merge-strategy:
+    description: >
+      How to merge open PRs: "squash" (default), "merge", or "rebase".
+    required: false
+    default: squash
+  dry-run:
+    description: >
+      If "true", classify and report but do not delete branches or merge PRs.
+    required: false
+    default: "false"
+  stale-days:
+    description: >
+      Branches with no unique commits vs base AND last-commit older than this
+      many days are classified as SUPERSEDED without asking.
+      Set to 0 to disable age check (unique-commit check only).
+    required: false
+    default: "30"
+  github-token:
+    description: >
+      GitHub token with repo write access (contents + pull-requests).
+      Defaults to the standard GITHUB_TOKEN.
+    required: false
+    default: ${{ github.token }}
+
+outputs:
+  merged-count:
+    description: Number of PRs merged.
+    value: ${{ steps.triage.outputs.merged_count }}
+  deleted-count:
+    description: Number of branches deleted (merged + superseded).
+    value: ${{ steps.triage.outputs.deleted_count }}
+  kept-count:
+    description: Number of REVIEW branches left untouched (need manual decision).
+    value: ${{ steps.triage.outputs.kept_count }}
+
+runs:
+  using: composite
+  steps:
+    - name: Configure git identity
+      shell: bash
+      run: |
+        git config --global user.email "actions@github.com"
+        git config --global user.name "GitHub Actions"
+
+    - name: Run branch triage
+      id: triage
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        BASE_BRANCH: ${{ inputs.base-branch }}
+        MERGE_STRATEGY: ${{ inputs.merge-strategy }}
+        DRY_RUN: ${{ inputs.dry-run }}
+        STALE_DAYS: ${{ inputs.stale-days }}
+      run: |
+        "${{ github.action_path }}/triage.sh"