ci: add Trivy vulnerability scanning workflow

[akandeadedayo01]

What

Adds a dedicated GitHub Actions security workflow that runs Trivy filesystem vulnerability scanning and
uploads SARIF results to GitHub Security.

Why

Fixes #234

How

The workflow runs on pushes to main, pull requests targeting main, and manual workflow_dispatch. It
uses aquasecurity/trivy-action to generate a SARIF report, then uploads it with github/codeql-action/ upload-sarif; forked PRs upload the SARIF as an artifact because they generally cannot write code scanning
results.

Testing

• go build ./... passes
• go test ./... passes
• go vet ./... passes
• golangci-lint run ./... passes
• Tested locally with: git diff --check

• N/A — CI workflow only
• sudo ./bin/bpf-verify --read 5s confirms 6/6 programs still load
• ./scripts/verify.sh passes (or specific phase: ./scripts/verify.sh quality)

Checklist

• PR title follows Conventional Commits (feat(scope): subject)
• All commits are DCO-signed (git commit -s)
• No unrelated changes pulled in
• Documentation updated where user-visible behavior changed
• Added/updated tests for new code paths
• If a new doctor rule, paired with a chaos scenario in scripts/verify.sh

[github-actions]

🚀 First PR — welcome aboard!

A few things to expect:

1. CI: every PR runs build + race tests + lint + (eventually) the kernel matrix. If something fails, the log will tell you exactly which gate.
2. DCO: every commit needs Signed-off-by: — git commit -s adds it automatically.
3. Conventional Commits: PR titles like feat(doctor): add new rule or fix(bpf): handle X. We squash-merge by default.
4. Review: a maintainer will review within 72 hours. Suggestions are conversations, not orders — push back if something doesn't fit your context.

If you get stuck, reply here or jump to Discussions. We want this PR to land.

[akandeadedayo01]

Fixes #234