Add security-advisory-publish workflow caller

[negillett]

Summary

• Add workflow_dispatch caller for OSV mirror verification after GHSA publish.

Test plan

• Agent precommit checkpoint

Depends on

• intentproof-infra #20

[cursor]

PR Summary

Low Risk
Adds a manually-triggered GitHub Actions workflow that calls a pinned reusable workflow in intentproof-infra; risk is low but depends on the external workflow behavior and inherited secrets.

Overview
Adds a new security-advisory-publish GitHub Actions workflow that can be run via workflow_dispatch with ghsa_id (required) and optional cve_id.

The job delegates to a pinned reusable workflow in IntentProof/intentproof-infra to verify OSV mirroring, using read-only contents/security-events permissions and secrets: inherit.

^{Reviewed by Cursor Bugbot for commit 4acdb51. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 642e734. Configure here.}