ci: add Semgrep SAST scanning on pull requests

[Sayan-]

Summary

Follow-up from the INC-51 postmortem (KERNEL-1191): the Kernel MCP vulnerability was missed in part because the MCP repo was not subscribed to the shared Semgrep workflow. Expanding the scope to the customer-facing SDKs so the same gap can't happen there.

This PR adds .github/workflows/semgrep.yml that calls the reusable workflow in kernel/security-workflows. Runs on every PR targeting `main` with the agent-powered triage flow already used in `kernel`, `kernel-images`, `cli`, `kernel-mcp-server`, etc.

Semgrep configs: `p/javascript`, `p/typescript`, `p/trailofbits`.

Uses org-level secrets already provisioned for existing subscribers (`CURSOR_API_KEY`, `CURSOR_PREFERRED_MODEL`, `ADMIN_APP_ID`, `ADMIN_APP_PRIVATE_KEY`, `SOCKET_API_TOKEN`) via `secrets: inherit`.

Stainless caveat

This SDK is Stainless-generated. Stainless doesn't appear to manage arbitrary files under `.github/workflows/`, but if the next regeneration wipes this file, we'll need to either add it to the Stainless config or restore it via a post-generation step.

Test plan

• CI runs on this PR itself (first scan of the repo). Verify the `Semgrep / scan` check appears and completes.
• If findings are produced, confirm the triage agent posts comments as expected.

Made with Cursor

---

Note

Medium Risk
Introduces a new CI job that runs a reusable workflow with secrets: inherit and pull-requests: write permissions, so misconfiguration could expose secrets or enable unwanted PR comments. Otherwise it’s isolated to CI and doesn’t change runtime behavior.

Overview
Adds a new GitHub Actions workflow, .github/workflows/semgrep.yml, that runs on PRs targeting main and invokes the shared kernel/security-workflows Semgrep workflow.

The scan is configured with the p/javascript, p/typescript, and p/trailofbits rule sets and grants the job PR write permissions (to post results) while inheriting org secrets.

^{Reviewed by Cursor Bugbot for commit 1db0f13. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: This PR only adds CI/CD configuration (Semgrep scanning workflow) and does not change any kernel API endpoints or Temporal workflows.

To monitor this PR anyway, reply with @firetiger monitor this.