docs: specify automated vulnerability visibility for production (R-VULN-*, ADR-0027)

Adds R-VULN-01..09, docs/17 and ADR-0027: a scheduled digest scanner in the
cluster, a versioned report, an SSO page listing each CVE against its images,
containers and workloads, grouped email alerts, and a Renovate-shaped CI triage
bot. Renovate stays the only author of version changes, and "not scanned" is
always visible rather than reading as clean.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

roadmap/phases.md

@@ -105,6 +105,17 @@ alerts live.
 
 ---
 
+## Phase 8 — Vulnerability Visibility
+**Status:** open; may proceed alongside Phase 7.
+**Entry:** ADR-0027 accepted.
+**Do:** deliver the scanner, report, CVE page, alerts and triage bot in
+[`../docs/17-vulnerability-visibility.md`](../docs/17-vulnerability-visibility.md).
+**Exit:** every running image is evaluated within its window or visibly reported as not evaluated;
+the acceptance gates in docs/17 pass.
+**Serves:** R-VULN-01..09.
+
+---
+
 ## Dependency flow
 
 ```