PR artifact cleanup cannot list organization packages, so nothing is cleaned up #212

What's wrong

PR artifact cleanup no longer fails, but it does not clean anything up. After the #210 rollout, "Cleanup PR Artifacts" runs in Cratis/Chronicle.Kotlin (run 40149607876) and Cratis/Orleans (run 40151716073) both succeeded with the warning:

Could not run: package inventory not authorized. No versions deleted.

The organization package listing (GET orgs/Cratis/packages?package_type=...) returns 401/403 for the token in use, so no PR-tagged NuGet or container versions are deleted anywhere, and they accumulate.

What to do

Create a classic PAT with read:packages and delete:packages, package-admin rights and SSO authorization if enforced, and store it as the organization secret PACKAGE_CLEANUP_TOKEN, available to the calling repositories and to Cratis/Workflows (README "Cleanup token"). Then check that the next cleanup run lists a cleanup-plan artifact instead of the warning.

This is an owner-only credential change.

Status

State: Paused — No code change needed. Verify on the next caller cleanup run (cleanup-plan artifact instead of 'not authorized'); manual dry run needs pr-package-cleanup environment approval by woksin. handoff: .worktrees/workflows-q73/.ai-work/q73/handoff.md
Branch: stage-710-arc-discovery-auth
Scope: PR artifact cleanup cannot list org packages (403); investigate token scope fix. Queued behind cli#204 shipping.
Delivered: Nothing yet.
Remaining: To be confirmed.
Follow-ups: None.