ops(ci): sweep closed-PR preview environments daily

[JSONbored]

Summary

Investigated why the repo had 1260 GitHub Environments — 1254 of them were preview/pr-<N> entries (spanning PR #4140–#8617), all for already-closed PRs.

Root cause: ui-preview.yml/ui-preview-deploy.yml (via the shared deploy-ui-preview composite action) call createDeployment({ environment: "preview/pr-<N>", transient_environment: true, ... }) for every PR that gets a UI preview build. GitHub auto-creates the Environment object the first time a deployment targets a name that doesn't exist — transient_environment: true is purely a display hint for the Deployments UI, it does not trigger any cleanup. Nothing in the repo ever called the delete-environment API. Confirmed none of the 1254 carry protection rules (pure disposable deploy-tracking metadata).

Immediate fix: swept and deleted all 1254 directly via the API (using my own already-sufficiently-scoped session token) — 0 environments remain today besides release, release-beta, preview, and two other pre-existing ones.

Ongoing fix (this PR): a new scheduled workflow, mirroring cache-cleanup.yml's existing fix for the identical class of problem (GHA caches instead of environments) — batched on a daily schedule (07:20 UTC, offset from the other daily cron cluster), not a pull_request: [closed] trigger, so PR-close bursts never queue a runner per event and compete with real CI for the org's concurrent-runner cap. There's no storage-budget urgency here the way there was for the 10GB cache cap, so daily (vs. cache-cleanup's 6-hourly) is plenty.

Required before this can actually run

ENVIRONMENT_ADMIN_TOKEN — a new repo secret. Deleting an environment requires repo scope (classic PAT) or Administration: write (fine-grained PAT) — confirmed against GitHub's own docs that the default GITHUB_TOKEN can never be granted this via a permissions: block, unlike cache deletion (which actions: write already covers). Scope a fine-grained PAT to this repo only with Administration: write, add it as a repo secret (not environment-scoped — this workflow doesn't use a GitHub Environment itself).

Test plan

• python3 -c "import yaml; yaml.safe_load(...)" — valid YAML
• npm run actionlint — clean
• Verified live: GET /repos/JSONbored/loopover/environments now returns 0 preview/pr-* entries

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.76%. Comparing base (a266d7a) to head (b75da18).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8620   +/-   ##
=======================================
  Coverage   92.76%   92.76%           
=======================================
  Files         797      797           
  Lines       79355    79355           
  Branches    24034    24034           
=======================================
  Hits        73616    73616           
  Misses       4592     4592           
  Partials     1147     1147           

Flag	Coverage Δ
backend	93.64% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.