docs: specify automated vulnerability visibility for production (R-VULN-*, ADR-0027)

Adds R-VULN-01..09, docs/17 and ADR-0027: a scheduled digest scanner in the
cluster, a versioned report, an SSO page listing each CVE against its images,
containers and workloads, grouped email alerts, and a Renovate-shaped CI triage
bot. Renovate stays the only author of version changes, and "not scanned" is
always visible rather than reading as clean.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

GLOSSARY.md

@@ -67,6 +67,11 @@ two things (e.g. "VM"), this file disambiguates.
 - **DR drill** — a tested restore of resources + volumes proving R-STATE-03.
 
 ## Delivery & lifecycle
+- **Coverage state** — whether a target was actually evaluated for vulnerabilities (`scanned`,
+  `pending`, `stale`, `failed`, `credential-required`, `by-tag`, `not-covered`). Zero findings means
+  something only in `scanned`. See [`docs/17-vulnerability-visibility.md`](docs/17-vulnerability-visibility.md).
+- **CVE triage bot** — the scheduled CI workflow that summarises the vulnerability report and asks
+  Renovate to open pending updates; it never authors a version change.
 - **GitOps** — desired state lives in git and is reconciled into the cluster automatically
   (pull-based). Engine: **Flux CD**.
 - **Drift correction** — Flux reverting live changes back to git-declared state (R-GITOPS-03).