ci: add centralized vuln remediation workflow

[ulziibay-kernel]

Thin caller to the reusable 3-stage pipeline (triage → fix → PR) in kernel/security-workflows.

Made with Cursor

---

Note

Low Risk
Low risk because this only adds CI configuration for a scheduled/manual GitHub Action and a socket.yml version pin; it doesn’t change runtime application code.

Overview
Adds a scheduled and manually triggerable Vulnerability Remediation GitHub Actions workflow that delegates to the reusable kernel/security-workflows pipeline with permissions to push fixes and open PRs.

Introduces socket.yml with version: 2.

^{Reviewed by Cursor Bugbot for commit cfcca41. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR only adds a CI workflow caller and does not modify API endpoints (packages/api/cmd/api/) or Temporal workflows (packages/api/lib/temporal).

To monitor this PR anyway, reply with @firetiger monitor this.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit cfcca41. Configure here.}

[cursor]

Workflow configures bun but project uses yarn

Medium Severity

The setup-bun: true input is passed to the reusable workflow, but this project uses yarn as its package manager (as declared by packageManager: "yarn@1.22.22" in package.json, the presence of yarn.lock, and all existing CI workflows using actions/setup-node). This mismatch could cause the remediation pipeline to install dependencies with the wrong package manager, leading to incorrect lockfile updates or failed runs.

 

^{Reviewed by Cursor Bugbot for commit cfcca41. Configure here.}