fix(ci): stop sweep-cf-orphans noise — drop merge_group + soft-skip when secrets unset

[HongmingWang-Rabbit]

Summary

The `sweep-cf-orphans` workflow shipped in #2088 was noisier than intended in two ways. This PR fixes both — was filed under the Optional finding I left on the original review and now matters because the noise is observably hitting the merge queue (every recent PR through the merge queue generated a red `Sweep CF orphans (merge_group)` run, plus the hourly schedule fires red continuously while secrets are unset).

Two fixes

1) Drop `merge_group` trigger

Was firing the entire sweep job on every PR going through the merge queue:

• `gh-readonly-queue/staging/pr-2091` → red
• `gh-readonly-queue/staging/pr-2092` → red
• `gh-readonly-queue/staging/pr-2093` → red
• `gh-readonly-queue/staging/pr-2094` → red
• `gh-readonly-queue/staging/pr-2095` → red
• `gh-readonly-queue/staging/pr-2097` → red

Comment in the workflow explains the re-add path if/when this workflow IS wired as a required check (re-add the trigger AND gate the sweep step with `if: github.event_name != 'merge_group'`).

2) Soft-skip secret check

`Verify required secrets present` previously `exit 2`'d when secrets weren't configured yet (the PR body's post-merge step, still pending). That meant the hourly schedule was painting red continuously.

Convert to:

• emit `::warning::` listing the missing secrets
• set `skip=true` step output
• gate the actual sweep step with `if: steps.verify.outputs.skip != 'true'`

Workflow reports green-with-warning while secrets stay unset; once they land, behavior is identical to today's (real sweep runs, hard-fails if a secret is later removed).

Test plan

• YAML parses (`python3 yaml.safe_load`)
• CI green on this PR (no Sweep CF orphans run on this PR specifically — the trigger drop is the whole point)
• After merge: confirm next hourly schedule run reports green-with-warning instead of red
• After merge: confirm subsequent merge-queue evals stop generating Sweep runs

🤖 Generated with Claude Code