feat(workflow): doc-orphan-detector cron backstop (doc-sweep §4.7)

[ArchonVII]

Summary

Add a new reusable workflow .github/workflows/doc-orphan-detector.yml — the doc-sweep gh-cron backstop specified in doc-sweep spec §4.7.

A gh-cron detector sees only pushed commits — committed-but-orphaned docs on stale branches (it cannot see uncommitted working-tree files; that is the local sweep's job). It is detection-only: it never commits, never pushes, and reports paths only, never file contents.

Algorithm (§4.7)

For every branch that has no open PR:

• diff origin/main...<branch>; collect changed paths matching the allow-list:
  • docs/** (EXCEPT docs/process/** and docs/architecture/**)
  • .changelog/**
  • .html-artifacts/**
  • image assets (*.png,*.jpg,*.jpeg,*.gif,*.webp,*.svg)
  • matched case-insensitively; exclude wins ties
• if any allow-list doc paths are present AND the latest commit touching those paths is older than a staleness threshold (input stale-hours, default 12) → open OR update a single idempotent tracking issue titled Doc orphans: <branch> (find existing open issue by title; update its body instead of duplicating). Body lists the orphaned paths + branch; label input base-label (default doc-orphan).

Inputs

• stale-hours (number, default 12) — source: owner decision 2026-06-02 (doc-sweep spec §4.3)
• base-label (string, default doc-orphan)
• default-branch (string, default main)

Pattern

Copies the structure of the existing anomaly-to-issue.yml: on: workflow_call with typed inputs, a single job, an explicit least-privilege permissions: block (contents: read, issues: write), actions/checkout@v4 (fetch-depth: 0), then actions/github-script@v7 with an inline script.

Spec: repo-template/docs/agent-process/doc-sweep.md §4.7.

Do NOT move the v1 tag — that is an owner step.