ci(internal-workflows): add monthly release-sweep for release-please PRs

[homelab-agent-bot]

Summary

Adds .github/workflows/release-sweep.yaml, a scheduled workflow that evaluates this repo's open release-please pull request on the 15th of every month and merges it automatically when it is safe to do so — a non-breaking patch/minor bump, no hold label, no merge conflicts, and every check green. It reuses ppat/homelab-ops-actions's release-sweep composite action, pinned to its current tagged release v2.3.2.

Why

This repo's release-please PR otherwise sits until someone manually clicks merge; a monthly sweep clears the routine, eligible ones without waiting on a human, while still holding back anything breaking or already flagged.

Scope and type, per this repo's new commit taxonomy (#899)

Scoped internal-workflows (rule 5: .github/workflows/** is this repo's own machinery), not github-actions — that scope is reserved for a diff that only moves an existing uses: ref, and this adds a new workflow. Typed ci, not feat: the pairing rule reserves feat/fix/perf/refactor/revert for the image/template/empty scopes that force a release of this repo's two deliverables, and release-sweep merges release-please's own PR without shipping the image or the template itself.

How it's wired

• Two triggers: schedule (17 3 15 * *, monthly on the 15th) runs live; pull_request scoped to this workflow file runs the same action in dry_run mode for visibility whenever the workflow itself changes — it never merges anything.
• Token: the schedule trigger mints a GitHub App token via actions/create-github-app-token, using HOMELAB_BOT_APP_ID/HOMELAB_BOT_APP_PRIVATE_KEY — the same App identity release.yaml already uses to run release-please itself — scoped to contents:write and pull-requests:write. The pull_request trigger uses the default read-only github.token instead, since it only dry-runs. The workflow's own permissions: block stays read-only either way; write access comes solely from the minted token.
• fetch-depth: 0: unlike every other workflow in this repo (which use the default fetch-depth: 1), this one needs full history — release-sweep's staleness guard compares the release PR's parent commit against origin/main, which isn't possible with a shallow clone.

Test plan

• pre-commit run --all-files (yamllint, commitlint) passes locally.
• actionlint passes locally.
• The pull_request dry-run trigger fires on this PR and reports what it would (not) merge — check its job output before merging.
• First live schedule run on 2026-10-15 confirms the merge path end-to-end (or sooner via manual inspection, since there's no workflow_dispatch trigger — omitted deliberately to keep the token/dry-run branching unambiguous, matching the source action's own dogfood workflow).