ci: add centralized vuln remediation workflow

[ulziibay-kernel]

Thin caller to the reusable 3-stage pipeline (triage → fix → PR) in kernel/security-workflows.

Made with Cursor

---

Note

Low Risk
Low risk: adds GitHub Actions automation and a minimal socket.yml config without changing application/runtime code. Main risk is workflow permissions (contents/pull-requests write) and reliance on an external reusable workflow pinned to main.

Overview
Adds a new scheduled and manually-triggerable GitHub Actions workflow (.github/workflows/vuln-remediation.yml) that calls the reusable kernel/security-workflows vulnerability remediation pipeline, granting write access to repository contents and pull requests and inheriting secrets.

Introduces a minimal socket.yml (version: 2) configuration file.

^{Reviewed by Cursor Bugbot for commit edff257. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR only modifies CI workflow configuration, not kernel API endpoints or Temporal workflows.

To monitor this PR anyway, reply with @firetiger monitor this.