Add scheduled OSV-Scanner workflow for existing dependency vulnerabilities

## Summary

GStack has dependency lockfiles (`bun.lock`, `lib/diagram-render/bun.lock`) and a growing Actions surface, but no scheduled OSV-Scanner workflow. That means newly disclosed vulnerabilities in the existing dependency graph are not surfaced on a recurring cadence unless they happen to be touched by a PR or found manually.

This is separate from the focused PR-time Dependency Review request in #1987. Dependency Review catches vulnerable dependency changes in pull requests. A scheduled OSV-Scanner run catches vulnerabilities disclosed after dependencies are already on `main`.

## Repo-local evidence

- `origin/main` tracks dependency lockfiles:
- `bun.lock`
- `lib/diagram-render/bun.lock`
- `origin/main:package.json` includes runtime dependencies such as `@ngrok/ngrok`, `diff`, `playwright`, and `puppeteer-core`, plus `@anthropic-ai/sdk` as a dev dependency.
- The repo has multiple CI workflows under `.github/workflows/`, including evals, image publishing, Windows gates, and document gates.
- Repo grep found no OSV scheduled scan wiring:
- `git grep -n -E 'osv-scanner|OSV-Scanner|google/osv|vulnerability scan|dependency-review|semgrep|scorecard|attest-build-provenance|attestation' origin/main -- .github package.json bun.lock lib/diagram-render/bun.lock README.md CONTRIBUTING.md docs`
- Only unrelated `docs/designs/v2_PLAN.md` text matched `scorecard`; no OSV workflow or vulnerability scan exists.
- Existing adjacent issues cover different layers:
- #1987 covers PR-time GitHub Dependency Review.
- #1997 covers OpenSSF Scorecard posture reporting.
- #2003 covers GHCR image artifact attestations.
- #1948 covers mutable action tags and provider-key exposure.
None of those add a scheduled full dependency vulnerability scan.

## External baseline

The official `google/osv-scanner-action` README says the action supports two modes:

1. Pull-request scanning that reports newly introduced vulnerabilities.
2. Full vulnerability scanning that can run on pushes, releases, or a regular schedule, with results reported to GitHub Code Scanning.

That second mode is the missing baseline here.

## Expected impact

- Surfaces vulnerabilities disclosed after a dependency is already merged, not just vulnerabilities introduced by new PRs.
- Gives maintainers a recurring Code Scanning signal for the current dependency graph.
- Complements #1987 instead of duplicating it: PR-time blocking plus scheduled main-branch monitoring cover different failure modes.

## Suggested fix

Add a focused workflow such as `.github/workflows/osv-scanner.yml`:

- Trigger on `schedule` and `workflow_dispatch`.
- Use least-privilege permissions:
- `contents: read`
- `security-events: write` if uploading SARIF to Code Scanning.
- Run `google/osv-scanner-action` pinned to a full commit SHA, not a mutable tag, to stay aligned with #1948 / #2009.
- Start non-blocking if needed, but upload SARIF or an artifact so maintainers can inspect findings.
- Include both lockfile surfaces: root `bun.lock` and `lib/diagram-render/bun.lock`.

## Duplicate check performed

- Inspected 200 open issues:
- `gh issue list --repo garrytan/gstack --state open --limit 200 --json number,title,body,labels,url,updatedAt`
- Inspected 200 open PRs:
- `gh pr list --repo garrytan/gstack --state open --limit 200 --json number,title,body,labels,url,updatedAt,headRefName,baseRefName,isDraft`
- Searched the inspected issue/PR title+body set for:
- `osv scheduled`
- `scheduled vulnerability`
- `vulnerability scan`
- `full vulnerability scan`
- `osv-scanner action`
- `google/osv-scanner-action`
- `code scanning vulnerability`
- Ran targeted GitHub searches:
- `"scheduled vulnerability" repo:garrytan/gstack`
- `"vulnerability scan" repo:garrytan/gstack`
- `"full vulnerability scan" repo:garrytan/gstack`
- `"osv-scanner action" repo:garrytan/gstack`
- `"google/osv-scanner-action" repo:garrytan/gstack`
- No exact covering issue or PR found. Adjacent non-duplicates: #1948, #1987, #1997, #2003, and PR #2009.

## Commands/files inspected

- `README.md`
- `CONTRIBUTING.md`
- `docs/ADDING_A_HOST.md`
- `docs/OPENCLAW.md`
- `docs/skills.md`
- `.github/workflows/skill-docs.yml`
- `.github/workflows/evals.yml`
- `.github/workflows/evals-periodic.yml`
- `.github/workflows/ci-image.yml`
- `.github/workflows/actionlint.yml`
- `package.json`
- `git fetch origin main --prune`
- `git ls-tree -r --name-only origin/main .github`
- `git ls-tree -r --name-only origin/main | egrep '(^|/)(bun.lock|package-lock.json|pnpm-lock.yaml|yarn.lock|deno.lock|go.sum|Cargo.lock)$'`
- `git grep -n -E 'osv-scanner|OSV-Scanner|google/osv|vulnerability scan|dependency-review|semgrep|scorecard|attest-build-provenance|attestation' origin/main -- .github package.json bun.lock lib/diagram-render/bun.lock README.md CONTRIBUTING.md docs`
- `gh repo view google/osv-scanner-action --json nameWithOwner,url,description`
- `gh api repos/google/osv-scanner-action/readme --jq .download_url | xargs curl -fsSL`
- Recent merged PRs inspected by title/files: #2004, #1990, #1966, #1951, #1929, #1916, #1912, #1911, #1910, #1909, #1908, #1907