docs: add docs for CVE-aware reboot recommendations feature

[PrinsonF77]

• Have you updated CHANGELOG.md with relevant non-documentation file changes?
• Have you updated the documentation for this change?

---

[Copilot]

🟡 Changes recommended

Documentation needs corrections and missing prerequisites before approval.

3 open findings

• Qualify reboot-notice removal by livepatch-aware policy · New
• Document required on-premises CVE lookup and sync configuration · New
• Add CVE lookup and sync prerequisites for on-premises clients · New

What changed in this PR

Adds documentation for CVE-aware kernel upgrade recommendations and reboot-notification policies.

Changes:

• Documents recommendation behavior, messages, and status output.
• Adds policy configuration and reboot-notice guidance.
• Updates navigation and CVE service deployment documentation.

File	Summary
docs/​server/​how-to-guides/​deployment/​deploy-cve-service-via-snap.md	Documents required CVE service features.
docs/​client/​reference/​platform/​kernel-upgrade-recommendation.md	Adds recommendation reference documentation.
docs/​client/​reference/​platform/​index.md	Links the new reference page.
docs/​client/​reference/​platform/​configuration-options.md	Documents the reboot policy option.
docs/​client/​how-to-guides/​operations/​check-client-status.md	Updates verbose status details.
docs/​client/​how-to-guides/​configuration/​index.md	Links the configuration guide.
docs/​client/​how-to-guides/​configuration/​configure-reboot-notification-policy.md	Adds policy configuration instructions.
docs/​client/​explanation/​troubleshooting/​do-i-need-to-reboot.md	Explains reboot recommendation behavior.
docs/​client/​explanation/​architecture/​reboot-marker-suppression.md	Explains reboot notice removal behavior.
docs/​client/​explanation/​architecture/​index.md	Adds architecture page navigation.
docs/​client/​explanation/​architecture/​how-kernel-upgrade-recommendations-work.md	Explains recommendation logic and requirements.

🧠 Review effort: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

Only minor documentation nits remain; no blocking issues were identified.

0 open findings

3 resolved since last review

• Add CVE lookup and sync prerequisites for on-premises clients
• Document required on-premises CVE lookup and sync configuration
• Qualify reboot-notice removal by livepatch-aware policy

🧠 Review effort: Lite

[Copilot]

🟡 Changes recommended

Documentation prerequisites, policy behavior, coverage limitations, and example CVE identifiers need correction.

2 open findings

• Preserve the limitation on high and critical CVE coverage · New
• Tie protected messaging to next-boot kernel CVE coverage · New

🧠 Review effort: Lite

[Copilot]

🔵 Needs a closer look

Correct the documented CVE comparison and reboot-marker/removal conditions.

0 open findings

2 resolved since last review

• Tie protected messaging to next-boot kernel CVE coverage
• Preserve the limitation on high and critical CVE coverage

Previously missed (1)

In code that hasn't changed since last review

State the actual next-boot CVE coverage condition

docs/​client/​reference/​platform/​kernel-upgrade-recommendation.md:28

This description is still too broad and makes the result ambiguous: coverage of CVEs in the running kernel does not establish that rebooting can wait when the next-boot kernel adds CVEs that the running kernel does not fix. Please state the actual condition used by the recommendation—Livepatch covers all CVEs fixed by the next-boot kernel that are not fixed by the running kernel—so this table agrees with the reboot-required explanation and message above.

🧠 Review effort: Lite

[Copilot]

🔵 Needs a closer look

Unresolved documentation-accuracy issues remain in recommendation semantics, reboot-notice behavior, and platform-specific guidance.

0 open findings

Previously missed (1)

In code that hasn't changed since last review

Base exit status 1 on next-boot kernel CVEs

docs/​client/​reference/​platform/​kernel-upgrade-recommendation.md:28

Exit status 1 is not based on Livepatch covering CVEs in the running kernel alone; the recommendation compares the CVEs added by the next-boot kernel against the applied live patches. As written, this contradicts the protected-result description below and can tell operators that a reboot may wait even when the next boot kernel introduces uncovered CVEs. Please describe status 1 in terms of the next-boot kernel's CVEs.

🧠 Review effort: Lite