ci: add Semgrep SAST scanning on pull requests

[Sayan-]

Summary

Follow-up from the INC-51 postmortem (KERNEL-1191): expanding the elevated vulnerability management scope to customer-facing SDKs.

This PR adds .github/workflows/semgrep.yml that calls the reusable workflow in kernel/security-workflows. Runs on every PR targeting `main` with the agent-powered triage flow already used across the other subscribed repos.

Semgrep configs: `p/javascript`, `p/typescript`, `p/trailofbits`.

Uses org-level secrets already provisioned for existing subscribers (`CURSOR_API_KEY`, `CURSOR_PREFERRED_MODEL`, `ADMIN_APP_ID`, `ADMIN_APP_PRIVATE_KEY`, `SOCKET_API_TOKEN`) via `secrets: inherit`.

Stainless caveat

This SDK is Stainless-generated. Stainless doesn't appear to manage arbitrary files under `.github/workflows/`, but if the next regeneration wipes this file, we'll need to either add it to the Stainless config or restore it via a post-generation step.

Test plan

• CI runs on this PR itself (first scan of the repo). Verify the `Semgrep / scan` check appears and completes.
• If findings are produced, confirm the triage agent posts comments as expected.

Made with Cursor

---

Note

Low Risk
CI-only change that adds automated static analysis on PRs; main risk is workflow permission/secret inheritance and potential noise from new findings.

Overview
Adds a new GitHub Actions workflow (.github/workflows/semgrep.yml) that runs Semgrep on every pull request to main using the reusable kernel/security-workflows workflow.

The scan is configured with additional rulesets (p/javascript, p/typescript, p/trailofbits), requests pull-requests: write permission for automated reporting, and inherits org-level secrets for the shared workflow.

^{Reviewed by Cursor Bugbot for commit 5896c80. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR only modifies CI configuration (.github/workflows/semgrep.yml) with no changes to API endpoints (packages/api/cmd/api/) or Temporal workflows (packages/api/lib/temporal).

To monitor this PR anyway, reply with @firetiger monitor this.