Add Agentic Workflow vulnerability triage

[jeffreyolio]

What's in this PR?

Alternative B: adds an organization-owned GitHub Agentic Workflow for Barnacle dependency-vulnerability triage, using the Codex engine.

Codex runs with read-only GitHub permissions inside the Agent Workflow Firewall. GitHub writes are available only through a path-restricted create-pull-request safe output that enforces draft status and never merges. The workflow adds threat detection, turn and cost limits, SHA-pinned actions and containers, and a pinned triage skill. A deterministic final job translates the safe-output result into Barnacle's versioned artifact contract.

This PR is mutually exclusive with the direct openai/codex-action workflow in #3; reviewers should choose one execution model.

Before

Repositories would need to build their own agent execution, sandbox, write controls, and result normalization.

After

Repositories can call one compiled reusable Agentic Workflow while Barnacle remains responsible for dispatch, Slack review, and lifecycle tracking.

QA Instructions

• Confirm the Markdown source compiles without validation warnings and the generated lock file pins its actions and container images.
• Confirm the Codex job is read-only and repository writes are available only through the configured draft pull-request safe output.
• After this workflow and one caller are merged, dispatch a synthetic no-change finding and confirm it produces barnacle-triage-<attempt_id> without opening a pull request.
• Dispatch a controlled remediation and confirm the safe-output publisher creates a draft pull request, returns its URL in the Barnacle artifact, and never merges it.

References

• Alternative A — direct Codex Action: Add direct Codex Action vulnerability triage #3
• Shared triage skill: https://github.com/GetJobber/jobber-skills/pull/193
• Barnacle integration: https://github.com/GetJobber/barnacle/pull/39
• Jobber caller: https://github.com/GetJobber/Jobber/pull/82089
• jobber-frontend caller: https://github.com/GetJobber/jobber-frontend/pull/14307
• GitHub Agentic Workflows
• Codex engine
• Pull-request safe outputs