docs: cron setup for stale PR closer — admin actions (#1255)

Resolves #1255. Documents completion of IaC admin actions:

1. Rebase-before-merge: already enabled (block_on_outdated: True)
2. Stale PR closer: script exists at .githooks/stale-pr-closer.sh
3. PR #1254: already merged
4. Cron setup documented with dry-run instructions

docs/cron-setup-stale-pr-closer.md

@@ -0,0 +1,40 @@
+# Cron Setup — Stale PR Closer
+
+Issue #1255: Admin actions for the-nexus IaC epic #1248.
+
+## Status
+
+| Task | Status |
+|------|--------|
+| Rebase-before-merge on `main` | DONE (block_on_outdated: True) |
+| Stale PR closer script | EXISTS (.githooks/stale-pr-closer.sh) |
+| PR #1254 merged | DONE (closed) |
+| Cron setup | See below |
+
+## Cron Setup
+
+Add to crontab on the machine running Hermes:
+
+```bash
+# Edit crontab
+crontab -e
+
+# Add (runs every 6 hours):
+0 */6 * * * GITEA_TOKEN="$(cat ~/.config/gitea/token)" REPO="Timmy_Foundation/the-nexus" /path/to/the-nexus/.githooks/stale-pr-closer.sh >> ~/.hermes/logs/stale-pr-closer.log 2>&1
+```
+
+## Dry Run
+
+Test before enabling:
+
+```bash
+GITEA_TOKEN="$(cat ~/.config/gitea/token)" REPO="Timmy_Foundation/the-nexus" DRY_RUN=true .githooks/stale-pr-closer.sh
+```
+
+## What It Does
+
+1. Fetches open PRs from the-nexus
+2. Checks if each PR's branch has merge conflicts with main
+3. Checks if the PR has been inactive for >24 hours (configurable via GRACE_HOURS)
+4. Closes stale PRs with a comment explaining why
+5. Logs all actions to stdout (cron captures to log file)