ci: add centralized vuln remediation workflow (#145)

Thin caller to the reusable 3-stage pipeline (triage → fix → PR) in
kernel/infra. Per-repo config in .github/vuln-remediation.json.

Made with [Cursor](https://cursor.com)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Medium risk because it introduces an automated workflow with
`contents`/`pull-requests` write permissions that can open PRs and
modify dependencies on a schedule.
> 
> **Overview**
> Adds a new GitHub Actions workflow, `vuln-remediation.yml`, that runs
weekly (and via manual dispatch) and calls the reusable
`kernel/security-workflows` vulnerability remediation pipeline,
inheriting secrets and using `go.mod` to select the Go version.
> 
> Introduces a minimal `socket.yml` (`version: 2`) configuration file.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
fe1d822. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: ulziibay-kernel

.github/workflows/vuln-remediation.yml

@@ -0,0 +1,17 @@
+name: Vulnerability Remediation
+
+on:
+  schedule:
+    - cron: '0 3 * * 3'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  remediate:
+    uses: kernel/security-workflows/.github/workflows/vuln-remediation.yml@main
+    with:
+      go-version-file: 'go.mod'
+    secrets: inherit

socket.yml

@@ -0,0 +1 @@
+version: 2