docs: specify automated vulnerability visibility for production (R-VULN-*, ADR-0027)

Adds R-VULN-01..09, docs/17 and ADR-0027: a scheduled digest scanner in the
cluster, a versioned report, an SSO page listing each CVE against its images,
containers and workloads, grouped email alerts, and a Renovate-shaped CI triage
bot. Renovate stays the only author of version changes, and "not scanned" is
always visible rather than reading as clean.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/14-testing-and-conformance.md

@@ -102,6 +102,10 @@ Each maps to requirement IDs; phrased as Given/When/Then intent.
   an email alert is delivered and the dashboard reflects it.
 - **GitOps drift (R-GITOPS-03, L3):** *Given* a reconciled resource, *When* it is mutated live,
   *Then* Flux reverts it to the git-declared state.
+- **Vulnerability visibility (R-VULN-*, L0/L1/L2/L3):** *Given* the running inventory, *Then* every
+  image is either evaluated within its window or visibly reported as not evaluated, and each CVE is
+  listed against its images, containers and workloads. Full list in
+  [17](17-vulnerability-visibility.md).
 - **Onboarding completeness (WS-APPS):** *Given* only a merged ServiceDefinition, *Then* the service
   is fully wired (compute/storage/policy/egress/TLS/DNS/monitoring/update) with no manual step —
   asserted by the union of the relevant tests above against that service.