ci: monthly [compat] prune audit (CompatPrune)

[ocots]

Part of #986. Caller of the reusable compat-prune workflow of control-toolbox/CTActions#95: a monthly (and on demand) audit of the [compat] entries of the CT* packages, from the top of the dependency graph.

Draft, merge after CTActions#95: the caller pins compat-prune.yml@main, which exists only once that PR is merged.

• schedule: the 1st of every month, 04:00 UTC.
• workflow_dispatch: with a dry_run input (default true).
• Every trigger is a dry run for now (report in the job summary, artifact, no PR, no issue). The scheduled run switches to publishing when the publishing job of CTActions#95 is enabled, after the GitHub App is set up.

A dry run of the same workflow already ran green in CTActions (self-test of #95): 42 prunes accepted, 0 rejected, 2 blocked entries; 35 lines edited in 6 repositories, 7 drifts in CTParser (its default branch is behind its registered version, cf. CTParser#326).

🤖 Generated with Claude Code

[ocots]

Superseded: the prune is the organization's, never a single package's, so it now runs from CTActions itself (compat-prune-monthly.yml, control-toolbox/CTActions#95), with its tracking issue in CTActions. OptimalControl carries no caller.