Patch Vulnerabilities

Recurring vulnerability management: fetch → fix → deactivate → PR → notify.

All vulnerability data comes from the Vanta API (no Notion). Reads and writes go through the bundled helper script, which authenticates with ~/.vanta-credentials.json.