Backfill remediated_at in vulnerabilities ES index

What does this MR do and why?

Adds BackfillRemediatedAtInVulnerabilities, a schema-version reindex migration for the vulnerabilities ES index, with its docs YAML entry and spec.

The mapping MR (!254185 (merged)) added remediated_at to the index, and the index-time MR (!254343 (merged)) populates it for new documents. This migration backfills remediated_at on documents indexed before that change, so the mean-time-to-remediate chart gets historical data.

Both prerequisite MRs are merged. As with the risk_score backfill, the chart will not show historical data until this migration finishes on GitLab.com.

Scope decisions

1. No non-SaaS companion migration. risk_score needed one because it depended on a Postgres background migration. remediated_at derives from existing columns (resolved_at, undetected_since), so there is nothing to wait for. Same approach as the latest_flag and organization_id backfills.
2. Only vulnerabilities is backfilled, not vulnerability_reads. That index is dual-written behind the default-off vulnerability_read_es_dual_write flag and nothing reads from it yet. Same choice as latest_flag and organization_id.

How to set up and validate locally

Elasticsearch must be running in your GDK for these to work.

bin/rspec ee/spec/elastic/migrate/20260908140000_backfill_remediated_at_in_vulnerabilities_spec.rb
bin/rspec ee/spec/elastic/docs_spec.rb

The migration spec includes an end-to-end example: it indexes a resolved vulnerability, strips remediated_at and lowers schema_version on the stored document, runs the migration, and asserts the document comes back with remediated_at equal to resolved_at.

To validate manually, with Elasticsearch enabled and a GDK that has vulnerability data, run the indexer and then the migration worker:

bundle exec rake gitlab:elastic:index
bin/rails runner 'Elastic::MigrationWorker.new.perform'

After the migration worker runs, check the gitlab-development-vulnerabilities index. Documents should have schema_version: 2607, and resolved vulnerabilities should have a remediated_at value.

Resolves #627296 (closed)

🤖 Generated with Claude Code