docs: specify automated vulnerability visibility for production (R-VULN-*, ADR-0027)

Adds R-VULN-01..09, docs/17 and ADR-0027: a scheduled digest scanner in the
cluster, a versioned report, an SSO page listing each CVE against its images,
containers and workloads, grouped email alerts, and a Renovate-shaped CI triage
bot. Renovate stays the only author of version changes, and "not scanned" is
always visible rather than reading as clean.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/11-automated-updates.md

@@ -78,6 +78,12 @@ each declared ceiling and carries any per-service cadence.
 - **Pin escape hatch**: an operator can pin a service via git if an upstream release misbehaves —
   the one sanctioned human touch, and it *stops* automation rather than performing an update.
 
+## Vulnerability-driven requests
+
+The CVE triage bot ([17](17-vulnerability-visibility.md)) can ask Renovate to open a pending update
+for an image with an unaccepted CRITICAL that has a fix, using Renovate's own dashboard approval.
+Renovate remains the only author of version changes, and every merge rule above still applies.
+
 ## Interaction with default-deny & egress
 Updates change image versions, not network posture. A VPN-class service stays VPN-class across
 updates; policies are reconciled from the (unchanged) ServiceDefinition.