ci: add centralized vuln remediation workflow

[ulziibay-kernel]

Thin caller to the reusable 3-stage pipeline (triage → fix → PR) in kernel/security-workflows.

Made with Cursor

---

Note

Medium Risk
Grants a workflow contents and pull-requests write access and runs on a schedule, which could create automated dependency-change PRs if misconfigured.

Overview
Introduces a new Vulnerability Remediation GitHub Actions workflow that runs weekly (and manually) and delegates to kernel/security-workflows/.github/workflows/vuln-remediation.yml, passing the repo’s go.mod for Go version resolution and inheriting secrets.

Adds a minimal socket.yml (version: 2) configuration file.

^{Reviewed by Cursor Bugbot for commit d4ab244. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR only modifies CI/workflow configuration files, not kernel API endpoints or Temporal workflows as specified in the filter.

To monitor this PR anyway, reply with @firetiger monitor this.