ci: add Socket Tier 1 Reachability Analysis workflow

[nicknisi]

Summary

Adds the Socket Tier 1 Reachability Analysis GitHub Actions workflow to the CLI repo, matching the existing workflow in authkit-nextjs. The workflow runs a daily Socket security scan (cron at midnight UTC) with manual dispatch support, using socket scan create --reach for full application reachability analysis against the workos org. Requires the SOCKET_API_KEY secret.

Changes

• Added .github/workflows/socket-tier1-analysis.yml — byte-for-byte identical to the authkit-nextjs reference workflow

What was tested

Automated

• Full test suite: 1153 tests passing across 78 test files
• TypeScript typecheck: clean
• Build: clean
• No regressions introduced (workflow-only change, no source code modified)

Manual

• YAML structure validated via scenario script:
  • ✅ Workflow name: "Socket Tier 1 Reachability Analysis"
  • ✅ Schedule: Daily cron at midnight (0 0 * * *)
  • ✅ workflow_dispatch with tags and distinct_id inputs (distinct_id required)
  • ✅ Concurrency: group by workflow + ref, cancel-in-progress
  • ✅ Job: ubuntu-latest, 60min timeout
  • ✅ Steps: All 4 steps (distinct_id check, checkout@v4, install socket, scan with --reach --org --no-interactive)
  • ✅ Env: SOCKET_SECURITY_API_TOKEN from secrets.SOCKET_API_KEY
  • ✅ Byte-for-byte identical to authkit-nextjs reference workflow

Verification

This is a CI workflow file addition — no UI or runtime behavior to screenshot. Verification was performed by parsing the YAML and comparing against the known-good authkit-nextjs reference workflow. All 8 structural checks passed and the file is byte-for-byte identical to the reference.

Follow-ups

None

[nicknisi]

Code Review Findings

Info

• [convention] The tested marker uses plain-text heuristic mode (fail_indicators: 1), which is a false positive from grep matching "fail"/"error" in test output text. Both implementer and verifier independently confirmed 1153/1153 tests passing. Consider piping JSON reporter output to mark-tested.sh for more accurate markers in future tasks. (.case/cli-mmxlinue-add-socket-tier-1-reachability/tested)

Automated review by case/reviewer agent