docs: specify automated vulnerability visibility for production (R-VULN-*, ADR-0027)

Adds R-VULN-01..09, docs/17 and ADR-0027: a scheduled digest scanner in the
cluster, a versioned report, an SSO page listing each CVE against its images,
containers and workloads, grouped email alerts, and a Renovate-shaped CI triage
bot. Renovate stays the only author of version changes, and "not scanned" is
always visible rather than reading as clean.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/00-vision-and-scope.md

@@ -150,6 +150,28 @@ mandatory; `SHOULD` is strongly preferred and requires an ADR to deviate.
 - **R-SEC-04** — The Kubernetes API MUST NOT be reachable from the public internet by any path (no
   tunnel route, no edge forward, no public DNS record); it is LAN/VPN-only (ADR-0016).
 
+### Vulnerability visibility — `R-VULN-*`
+- **R-VULN-01** — The platform MUST maintain an inventory of every container image running in
+  production, by digest, mapped to the namespaces, workloads and containers using it, taken from the
+  running cluster and not from git.
+- **R-VULN-02** — Every running image MUST be evaluated against a current vulnerability database at
+  least every 24 hours, and a newly running image within 2 hours.
+- **R-VULN-03** — Any target not successfully evaluated MUST be visibly reported as such with its
+  reason. Absence of data MUST NOT be presented as absence of vulnerabilities.
+- **R-VULN-04** — An authenticated page MUST list every known CVE and, for each, the images,
+  containers and workloads it affects, and MUST be searchable and filterable.
+- **R-VULN-05** — Inventory, scanning, reporting and triage MUST run on a schedule with **no human
+  and no AI action**, and MUST fail loudly when they cannot run.
+- **R-VULN-06** — Scan failure, staleness, and unaccepted CRITICAL vulnerabilities with an available
+  fix MUST be reported by **email**, as grouped alerts.
+- **R-VULN-07** — A scheduled bot MUST maintain a single dashboard issue and request remediation
+  through Renovate. Renovate MUST remain the only author of version changes, and CVE detail MUST NOT
+  be published to any surface readable without authentication.
+- **R-VULN-08** — Accepted risk MUST be declared in git, through the merge gate, with a reason and a
+  mandatory expiry, and MUST revert to open automatically when it expires.
+- **R-VULN-09** — The scanner MUST be digest-pinned, MUST NOT auto-merge its own updates, MUST NOT
+  read Secrets or hold Kubernetes write access, and MUST hold no git credential.
+
 ### Identity & access (SSO) — `R-IDP-*`
 - **R-IDP-01** — The platform MUST provide a central Identity Provider (SSO) as the single user
   directory and login for platform services.