Make CVE fix skill self-contained

.agents/workflows/cve-fix.md

@@ -1,10 +1,10 @@
 #### Fixing CVEs
 
-**Automated:** Use `/cve-fix` in Claude Code or `make cve-fix` from shipyard:
+**Automated:** Use `/cve-fix` in Claude Code or `make -C skills/cve-fix` from shipyard:
 
 ```bash
-/cve-fix release-0.23 ../submariner-operator
-make cve-fix REPO=../submariner BRANCH=release-0.23
+/cve-fix submariner-operator 0.23
+make -C skills/cve-fix REPO=submariner BRANCH=0.23
 ```
 
 The steps below are the manual process for reference.
@@ -182,7 +182,16 @@ If fix requires breaking changes (Go version, K8s major version, incompatible AP
 - CVE severity (Low/Medium vs High/Critical)
 - Cost/risk of breaking stable branch dependencies
 
-Add to `.grype.yaml`:
+**No fix available** — use `fix-state: not-fixed` so the entry auto-expires when a fix is published:
+```yaml
+# No fix available for [package]. [context].
+- vulnerability: GHSA-xxxx-xxxx-xxxx
+  fix-state: not-fixed
+  package:
+    name: package.name/path
+```
+
+**Fix exists but would break the branch** — permanent ignore (no fix-state):
 ```yaml
 # Update requires [incompatibility]. [Severity] doesn't justify breaking changes.
 - vulnerability: GHSA-xxxx-xxxx-xxxx

Makefile

@@ -5,7 +5,7 @@ LOCAL_COMPONENTS := submariner-metrics-proxy
 MULTIARCH_IMAGES ?= $(IMAGES)
 EXTRA_PRELOAD_IMAGES := $(PRELOAD_IMAGES)
 PLATFORMS ?= linux/amd64,linux/arm64
-NON_DAPPER_GOALS += images multiarch-images cve-fix cve-clean
+NON_DAPPER_GOALS += images multiarch-images
 PLUGIN ?=
 
 export LOCAL_COMPONENTS
@@ -65,13 +65,6 @@ deploy deploy-latest e2e upgrade-e2e: package/.image.nettest
 
 include Makefile.dapper
 
-# CVE fix scripts
-cve-fix:
-	./scripts/cve/fix-all.sh "$(or $(REPO),.)" "$(or $(BRANCH),$(shell git branch --show-current))"
-
-cve-clean:
-	./scripts/cve/clean.sh
-
 # Make sure linting goals have up-to-date linting image
 $(LINTING_GOALS): package/.image.shipyard-linting