ops: remove stale branches after rc.1 closure

Author: fraware

.github/workflows/temporary-final-branch-cleanup.yml

@@ -0,0 +1,47 @@
+name: Temporary final branch cleanup
+
+on:
+  push:
+    branches:
+      - ops/final-branch-cleanup
+    paths:
+      - .github/workflows/temporary-final-branch-cleanup.yml
+
+permissions:
+  contents: write
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 1
+      - name: Remove stale release/development branch refs
+        run: |
+          set -euo pipefail
+          branches=(
+            'adoption-surface-v1.3.0-rc.1'
+            'docs/consumer-gate-v1.2.1'
+            'feat/verifier-assurance'
+            'feature/sigstore-dry-run-path'
+            'feature/sigstore-keyless-release'
+            'feature/sigstore-status-note'
+            'feature/solver-agnostic-control-plane'
+            'feature/sprint1-execution-models-schemas'
+            'hardening/final-release-closure-2026-08-25'
+            'hardening/full-vision-2026-08-24'
+            'hardening/release-sbom-attestation'
+            'pf-va/pin-ovk-basic-v0-profile'
+            'r2-engineering-program-2026-07-23'
+            'release/rc1-final-status-and-ref-protection'
+          )
+          for branch in "${branches[@]}"; do
+            git push origin --delete "$branch" || {
+              echo "failed to delete $branch" >&2
+              exit 1
+            }
+          done
+      - name: Delete cleanup branch
+        if: always()
+        run: git push origin --delete ops/final-branch-cleanup