chore(ci): enable the agentic Open Source fix [AG-387]

snyk/prodsec-orb#166 is merged and released in v1.2.29, so there is no dev orb pin -
the orb reference stays at @1 and picks the feature up.

main already carries the prodsec-orb-runtime context on the code-analysis job, which
is where REMY_LITELLM_API_KEY, REMY_LITELLM_BASE_URL, REMY_LITELLM_MODEL and
REMY_GITHUB_TOKEN come from, so this is now a single parameter.

open-source-scan stays at high. An earlier revision of this branch lowered it to
medium for the trial; that is reverted, so what blocks this repository is unchanged.
Note this repository already sets open-source-block-ignore-sla, so a high-severity
vulnerability blocks immediately rather than after its remediation SLA - which is what
will trigger the fix.

When the Enhanced Gate blocks the Open Source scan the job still fails exactly as it
does today, and in addition `snyk fix --agentic` runs against the blocking
vulnerabilities and opens a pull request against the branch that failed. The fix step
always exits 0, so it cannot turn a passing build red or mask a failure.

Two things worth knowing: enabling this adds a github-cli/install step that runs on
every build of this repository, not only blocked ones, and `snyk fix` runs this
repository's dependency lifecycle scripts in the same job that holds the context
secrets.

Rebuilt on main rather than rebased: the branch's previous commits were dev-orb bumps
that have no meaning now the orb is released.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ShawkyZ

.circleci/config.yml

@@ -1524,6 +1524,7 @@ jobs:
           open-source-scan-reachability: true
           open-source-scan: high
           open-source-block-ignore-sla: true
+          open-source-agentic-fix-enabled: true
 
   docs-only-check:
     executor: docker-amd64