Summary

Our issue automation only grew the backlog — issue-triage labels and issue-arborist clusters into parent/sub-issue trees, but nothing pruned it. As a result the open backlog was dominated by self-superseding bot-authored issues: ~34 [deps-release-notes] issues (one per upstream release), repeated [aw] … failed / rate-limit failure reports, and superseded recompile-fixture chores.

This PR adds the missing cleanup and stops the churn at its source.

1. update-awf-version — single rolling issue per dependency (edit)

Previously filed a new [deps-release-notes] <token> v<version> action items issue for every upstream release. Now it maintains one canonical rolling issue per component (awf / mcpg / copilot-cli), titled:

[deps-release-notes] <token> — upstream release action items

and appends a comment per version bump (creating the canonical issue only if none exists). Adds add-comment to safe-outputs; keeps close-issue for strays. PR-body "Action Items" wording updated to point at the rolling issue.

2. deps-notes-consolidator — backlog backfill (new, weekly + workflow_dispatch)

Per component: picks the newest issue as canonical, rewrites its body into a consolidated earliest→latest history (preserving every action-item bullet and release link), retitles it to the stable versionless form, and closes the superseded per-release issues as not_planned. Collapses the current 34 → 3.

3. stale-bot-issue-janitor — duplicate/superseded closer (new, weekly + workflow_dispatch)

Closes, keeping only the most recent of each:

• Exact-title [aw] … failure-report duplicates (e.g. Documentation Freshness Check failed, hit AI credits rate limit).
• Superseded chore(workflows): recompile safe-output fixtures with ado-aw vX issues (keeps highest version).

Safety rails: candidate set is restricted to --author app/github-actions (can never touch a human issue), singletons are never closed, and there's a hard never-close protect-list for the healthy rolling aggregates [aw] No-Op Runs (#13) and [aw] Detection Runs (#793).

Test plan

• CI=true gh aw compile <name> for all three workflows — 0 errors, 0 warnings each; .lock.yml files regenerated.
• Verified compiled safe-output configs in the lock files:
  • update-awf-version: add_comment + close_issue (both target:"*", prefix [deps-release-notes] ).
  • deps-notes-consolidator: update_issue (title+body, target:"*") + close_issue (not_planned).
  • stale-bot-issue-janitor: close_issue (target:"*", not_planned, max 40).
• Reverted incidental EOL-only churn in agentics-maintenance.yml (content-identical).
• Post-merge: run the two new workflows via workflow_dispatch to perform the initial sweeps.