ci(vercel): prune stale Preview deployments after PR closure

[qnbs]

Problem

The existing .github/workflows/prune-deployments.yml prunes GitHub Deployment records, but it does not remove the corresponding Vercel Preview deployment artifacts. A bounded live housekeeping pass confirmed that stale previews can accumulate after merged or closed pull requests.

Required policy

• never delete Production deployments or Production/Main aliases;
• retain the newest three Preview deployments for each open PR, including its active branch alias;
• after a PR is merged/closed, remove its Preview deployments after a bounded grace period when no active alias or review evidence requires them;
• remove stale failed/canceled previews only after confirming they are detached from active work;
• classify unknown metadata conservatively and never delete it blindly;
• perform a dry-run manifest, rate-limited authenticated API deletion, and post-cleanup verification;
• redact creator emails and tokens from logs/reports.

Scope

Design the smallest authenticated Vercel API/CLI housekeeping integration or documented operator workflow. Preserve Production, domains, project settings, environment variables, rollback history, and active review previews. Do not change deployment creation or promotion semantics.

[qnbs]

Vercel retention reconciliation after #628 resulting-main 872b6f4: project/team/repository scope matched, Production remained READY with its protected aliases, and no open PRs were present. Twelve non-Production Preview deployments were classified by closed/merged PR or branch lifecycle; each still carries a branch alias, so the merged policy's no-protected-alias gate did not prove deletion safe. No alias or deployment was deleted.

Carry-forward for #627: future automation must explicitly reconcile orphaned closed-PR/branch aliases before any per-ID deletion, with the same current-main, target, terminal-state, project/team/repository, rollback/promotion, open-head, review-evidence, alias and post-delete revalidation gates. Preserve ambiguous alias state as UNKNOWN_REVIEW_REQUIRED; never use a broad fallback.