docs: add patch deferral revalidation gates

[catcherintheroad-hub]

Created from review issue: #1401

Summary

• Add deferred vulnerability revalidation gates to patch-prioritization
• Require early re-triage when vendor patches, CISA KEV status, EPSS trends, public exploits, asset exposure, or compensating control validation change
• Add edge-case fixtures for patch availability, KEV/EPSS escalation, exposure drift, failed compensating controls, and documented no-change revalidation

Validation

• git diff --check
• Markdown fence balance and ASCII check for touched files
• Reference URL checks for SSVC, EPSS, CISA KEV, and CISA BOD 22-01

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6133d618e1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Include the revalidation owner in the exact output table

When a deferred item has no material change, the new validation fixture requires the report to record the owner, and the trigger list also calls out owner accountability at 50% duration, but this exact output table has no Owner column. Agents following the required format can satisfy the table while omitting who owns the next revalidation, undermining the accountability gate this change adds.

Useful? React with 👍 / 👎.