docs: specify automated vulnerability visibility for production (R-VULN-*, ADR-0027)

Adds R-VULN-01..09, docs/17 and ADR-0027: a scheduled digest scanner in the cluster, a versioned report, an SSO page listing each CVE against its images, containers and workloads, grouped email alerts, and a Renovate-shaped CI triage bot. Renovate stays the only author of version changes, and "not scanned" is always visible rather than reading as clean. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-11-09 09:21:52 -06:00
1 parent c626349c7d
commit 0fb44bb0a8
@@ -37,6 +37,8 @@ root aggregates and links them. Status of this composition is tracked in
 - **Platform health**: node status, Longhorn capacity/health, Flux reconciliation, cert expiry,
  backup status, VPN tunnel state — sourced from the observability stack ([10](10-observability-and-alerting.md)).
 - **Alerts**: current firing alerts (mirrors what email delivers).
+- **Vulnerabilities**: a link to the CVE page, restricted to `platform-admins`
+  ([17](17-vulnerability-visibility.md)).

 ## Actions (safe, audited)