security watch sees runtimes (R-1327) and DooPlex (R-1328); HTTP2Shell rows R-1329–R-1332; R-1326 closed

- scripts/image_runtime.py: Node / Python Brotli / brotlicffi / apk / dpkg read from an image's registry config and
  layers (no pull; HEAD for the nightly digest; zstd via the zstd program where present; quay.io, index.docker.io).
- security_watch.py: a „runtime" source (security_watch_runtimes.json), cached by digest in state.json (154 images,
  filled on DooPlex tonight); ghcr.io tag lists are paged; the DooPlex group (own block, homelab next-step).
- dooplex_inventory.py + documentation/security-watch/dooplex-workloads.txt (89 images, homelab-manifests 5aeec8d).
- Tests W10–W12 (58 checks) + test_image_runtime.py (13), each red-proved.
- audits/http2shell-2026-10-27: the Home Assistant lane walk (proven), HOMELAB-LIST.md (19 to update), the run log.
- 08 §11 design line; 09 §3 decision 276 (HA monthly = same main version; decided by CC unattended).

documentation/architecture/09-update-architecture.md

@@ -1145,6 +1145,14 @@ its length, and both fixes cost something the household would notice — operato
      overwrite its records with no login; no box runs it; an installed copy is not touched. *Operator, 2026-10-27 21:33
      (CC's pick).*
 
+276. **A Home Assistant monthly release (2026.9 → 2026.10) is the SAME main version for the ladder, so a security fix
+     may ride the lane.** *Decided by CC unattended 2026-10-27 — operator may reverse.* Options: A) the lane — the one
+     comparator (`stacks.CompareImageRefs`, Q3) parses „2026" as the major, a notice id exists (CVE-2026-111497, Python
+     Brotli 1.2.0 → 1.2.1 inside the image); cost: a monthly HA release carries feature changes into the night lane;
+     B) a normal step — cost: a second rule beside the comparator for one app's version shape (Q3 warns that is how a
+     major gets automated by accident). Why A: the brief („a normal step if it counts as a main version in our ladder
+     rules, else the lane") and the one-comparator rule; the box walk + soak is the guard either way.
+
 ### 2026-10-27 (attended release block) — the line-test hold is fixed the same day; R-1218's live proof is waived
 
 269. **The line-test hold waits until the held app has really slowed down — fixed in the controller the same day.**