Add Next Maintainer auto-close workflow

[marcoshernanz]

Summary

• add a manually dispatchable workflow; the hourly schedule is left commented until initial production verification
• keep the workflow YAML small and place delivery in .github/scripts/next-maintainer-auto-close.js for normal code review
• use a short-lived exact-audience GitHub Actions OIDC token with no long-lived secret
• trust the authenticated queue contract instead of reimplementing its Zod validation in the workflow
• post the verifier-authored comment and close with GitHub native completed, not planned, or duplicate state reasons
• retain one invisible marker only to prevent duplicate public comments across retries

If an issue is open with the marker, the workflow leaves it open. This intentionally lets a human reopen win and avoids timeline reconstruction.

Permissions

The job grants only contents: read, id-token: write, and issues: write; every other permission remains none. Both GitHub actions are pinned to full commit SHAs. Checkout is sparse to the one trusted JavaScript file and has credential persistence disabled.

Verification

• mocked delivery harness passes ten scenarios: empty queue, completed, not planned, duplicate, pull-request rejection, already-closed recovery, independent close, open marker, transferred issue, and transient failure
• node --check, Prettier, and ESLint pass for the extracted implementation
• Vercel Agent Review, Vercel Security Review, Socket Security, workflow change detection, and documentation validation pass
• production workflow_dispatch succeeded end to end: https://github.com/vercel/next.js/actions/runs/33788887152 (OIDC authentication, Trusted Sources, production queue request, and clean empty-queue response)

Dependency

This is the narrow GitHub write-side companion to vercel-labs/next-maintainer-agent#541, which is deployed. vercel-labs/next-maintainer-agent#546 further reduces the queue DTO and changes the delivery limit to 25 first claims per rolling week; this workflow is compatible with both DTO versions.

[vercel]

@marcoshernanz is attempting to deploy a commit to the Internal Playground Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Tests Passed

Commit: 7bad8d7

[bgw]

/eve/eve/eve/eve