Stale bot will auto-close tracked work, including security follow-ups; exempt labeled issues #41

Evidence

.github/workflows/stale.yml marks any issue or PR stale after 30 days and closes it after 7 more, with no exemptions. #22, a deliberately deferred follow-up from the security PR #21, is already labeled stale and will be closed automatically even though it's planned work.

On a project with one maintainer and a slow issue cadence, this closes the backlog instead of grooming it, and contributors take it as a signal that the project isn't listening.

Suggested approach

• Add exempt-issue-labels: "security,priority: critical,priority: high,decision,pinned" and exempt-all-milestones: true.
• Increase days-before-stale to 60 for issues, or turn stale-closing off for issues and keep it only for PRs.
• Remove the stale label from refactor(partner): align partner-admin refusal shape with shared confirm gate #22.
• Optionally bump actions/stale to the current major.