fix(SOF-8032): add grace period before deleting non-tip WIP releases

[k0stik]

Summary

• cleanup-wip-releases.yml's only staleness check was "is this tag's sha still a branch tip" (git ls-remote --heads) — a release stops counting as a branch tip the moment ANY new commit lands on that branch, regardless of whether another repo's package.json still depends on that exact tarball.
• This broke job-designer's Netlify build: ive's wip-2a8a93e was pinned in job-designer/package.json, but a later commit on ive's same branch (no [release] tag of its own) moved the tip past it, so the next scheduled Monday cleanup deleted it — 404ing npm install.
• Adds min-age-days (default 14) as a second, independent AND-gate: a non-tip release is only deleted once it's also older than the grace period.

Why this shape

• No cross-repo dependency awareness needed (which would be expensive/impractical to implement generally) — just enough time for someone to notice a pinned tarball got superseded and repin it.
• All 22 mat3ra/* callers of this reusable workflow pick up the new default with zero changes on their end.

Test plan

• yamllint clean except two pre-existing warnings unrelated to this change (verified via git stash diff)
• Verified the date -u -d age arithmetic against real GNU date in an ubuntu:24.04 container (matches runs-on: ubuntu-latest), confirming a 4-day-old release correctly evaluates as "keep" under the 14-day default
• Not run against real GitHub API / real releases (would require live gh auth against a target repo)

🤖 Generated with Claude Code