ci: add centralized vuln remediation workflow

[ulziibay-kernel]

Thin caller to the reusable 3-stage pipeline (triage → fix → PR) in kernel/security-workflows.

Made with Cursor

---

Note

Low Risk
Low risk because it only adds CI configuration and does not change runtime code; main risk is workflow permissions (write access) and any unintended PRs from the automation.

Overview
Introduces a new GitHub Actions workflow, vuln-remediation.yml, that runs weekly (and on manual dispatch) and delegates vulnerability triage→fix→PR creation to the reusable kernel/security-workflows pipeline, with contents/pull-requests write permissions.

Adds a minimal socket.yml (version: 2) configuration file.

^{Reviewed by Cursor Bugbot for commit 9bdc52a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR modifies CI/workflow configuration, not kernel API endpoints or Temporal workflows.

To monitor this PR anyway, reply with @firetiger monitor this.