Helix PatchSecurity remediation

Trivy scans, campaigns, and helix-ee remote verify + actions.

Trivy scans

Batch or campaign scan (FS and image). Scanner stays in Patch, not HEE.

Closed loop — remediate, wait for merge, rescan until policy is met.

Verifiers gate sessions; actions run Patch tools the brain requests over HTTP.