docs: specify automated vulnerability visibility for production (R-VULN-*, ADR-0027)

Adds R-VULN-01..09, docs/17 and ADR-0027: a scheduled digest scanner in the
cluster, a versioned report, an SSO page listing each CVE against its images,
containers and workloads, grouped email alerts, and a Renovate-shaped CI triage
bot. Renovate stays the only author of version changes, and "not scanned" is
always visible rather than reading as clean.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/10-observability-and-alerting.md

@@ -62,6 +62,9 @@ Grafana dashboards, surfaced in the C2 UI ([12](12-command-center-ui.md)):
 - **Network**: Hubble flows, egress/VPN health, denied-flow trends.
 - **Per-service**: one row/dashboard per catalog service with its declared SLIs.
 
+The CVE listing is deliberately **not** a Grafana dashboard: per-CVE data does not belong in
+Prometheus. See [17](17-vulnerability-visibility.md), which also defines the vulnerability alerts.
+
 ## Observability as onboarding output
 
 The ServiceDefinition ([13](13-service-catalog.md)) declares observability expectations; the