feat(security): autonomous no-fix VEX + documenting PR

[ry-ops]

What & why

You asked: VEX is state, but a PR still needs to be created to identify the no-fix state and document that a dependency has no available fix — and vex-no-fix.mjs should run autonomously. This does both.

Before

• No-fix alerts were only VEX'd affected after a 3-sweep ADR-006 hard-stop.
• vex-no-fix.mjs (which writes the honest under_investigation state) was manual — keytar-only auth, never in the heartbeat — and produced no artifact in the target repo.

Now

vex-no-fix.mjs:

1. Dual-auth (GH_TOKEN in CI, keytar locally) → runs unattended.
2. Records OpenVEX under_investigation to git-steer-state (_vex + vex.jsonl) — unchanged.
3. Opens/refreshes a documenting PR in each affected repo committing an OpenVEX 0.2.0 doc at .well-known/openvex/no-fix.openvex.json — a visible, machine-consumable artifact stating no fix is available, plus a human-readable PR body table.
   • Doc-only → merged directly (no functional-integrity gate; nothing to build). If branch protection blocks, labeled needs-human-merge.
   • Idempotent: skips when the repo's doc already matches; entries clear automatically as upstream fixes land.
4. Wired into the daily heartbeat after the escalation sweep.

under_investigation is the honest automated state; a maintainer later promotes each to not_affected (+justification) or affected (+action_statement) via vex_set.

Verified

• toOpenVex produces valid OpenVEX 0.2.0 (tested with real DriveIQ no-fix advisories: nltk, torch).
• Build clean, 42 tests pass, heartbeat + script syntax valid.

🤖 Generated with Claude Code