chore: enable nightly CVE remediation

[brendan-kellam]

Summary

• run CVE remediation nightly after vulnerability triage
• support manual runs with a configurable issue batch size
• reuse Sourcebot’s shared remediation workflow and assets

Validation

• verified the caller matches the Lighthouse implementation
• parsed the workflow as YAML
• ran git diff --check

---

Note

Low Risk
Adds CI automation only; no application runtime or auth logic changes, though inherited secrets and write permissions follow the shared remediation workflow’s behavior.

Overview
Adds a new GitHub Actions workflow cve-remediation.yml that runs CVE remediation on a schedule and on demand.

Schedule: daily at 08:00 UTC (comment notes ~1:00am Pacific during DST). Manual runs accept max_issues (default 50) to cap how many unlinked CVEs are processed per run.

The job delegates to Sourcebot’s reusable workflow sourcebot-dev/sourcebot/.github/workflows/_cve-remediation.yml@main, passing asset repo/ref and max_issues, with secrets: inherit. Concurrency is keyed per repository with cancel-in-progress: false so overlapping runs are not cancelled. Permissions grant write on contents and pull requests, plus id-token and actions: read for the shared remediation flow.

^{Reviewed by Cursor Bugbot for commit 2dde6ac. Bugbot is set up for automated code reviews on this repo. Configure here.}