feat: add linear cve summary action

[vcauesantos]

Summary

• add a structured result-json output to cve-scan and aggregate matrix results into one Linear comment
• link tag-triggered summaries to Code Scanning findings filtered by the actual SARIF tag ref, and every summary to the exact workflow run
• scope parent discovery to the Engineering team, then resolve through release-derived title fingerprints and immutable parent-child relationships without calling-repository, child-team, or label coupling
• keep Linear failures advisory and idempotent while preserving scan results and warnings in the GitHub step summary
• provide an explicit kill switch and a read-only dry-run mode that resolves the real Linear target without mutating it
• paginate Linear lookups, isolate malformed matrix outputs, and exercise safety-control wiring through the composite manifest

Example Linear comment

The action adds a comment like this to the release's CVE review subissue (illustrative counts):

CVE scan summary — v0.38.0-rc.2

Image	Critical	High	Medium	Low	Status
vcluster-pro	0	2	11	4	Completed
vcluster-oss	0	1	6	3	Completed
vcluster-cli	0	0	2	1	Completed

Detailed findings in GitHub Code Scanning

GitHub Actions run

This report is advisory and did not gate the release.

The real comment uses the originating run ID and actual scan counts. A missing matrix result is rendered as No scan result. A hidden tag-specific marker makes reruns update the existing comment while incremental RCs add separate comments.

Test plan

• make test-cve-scan (137 passed)
• make test-linear-cve-summary (30 passed)
• make lint
• make check-docs
• native matrix output fan-in validated in vClusterLabs-Experiments/github-actions-test#29
• make test reaches an unrelated existing cleanup-head-charts failure that reproduces on main; all tests before it, including this action's suite, pass

Rollout

• move the existing cve-scan/v1 rolling tag first so callers receive the new result-json output
• publish the linear-cve-summary/v1 action-specific tag after merge
• merge loft-sh/vcluster-pro#2437 only after both tags point to this release

Related to DEVOPS-1292

[vcauesantos]

/vcluster-review

[vcluster-pr-approver]

🔍 The agent swarm is reviewing PR #263. I'll post the results here when it's done.

Admins can watch the run live

[vcluster-pr-approver]

@vcauesantos ✅ Review finished for #263

View the session

[vcauesantos]

Validated the load-bearing matrix output fan-in against the native GitHub Actions runner.

• Throwaway integration PR: test: verify matrix output fan-in vClusterLabs-Experiments/github-actions-test#29
• Successful workflow run: https://github.com/vClusterLabs-Experiments/github-actions-test/actions/runs/34640631398
• Three matrix legs exported the exact unique keys used by the vCluster caller (vcluster-pro, vcluster-oss, and vcluster-cli) with structured result-json payloads.
• The downstream job received and validated all three outputs.
• The probe used no Snyk scan, secrets, or Linear mutation.