docs: Describe the Windows agent's update and workload support

docs/vantage/servers.md

@@ -89,10 +89,13 @@ metrics is normal rather than a fault.
 
 ### OS updates
 
-Agents check for pending package updates hourly and report the count. From the
-server page you can:
+Agents check for pending package updates hourly and report the count — the
+machine's own package manager on Linux, the Windows Update COM API on Windows.
+From the server page you can:
 
-- **Apply updates** runs the machine's own package manager and reports back.
+- **Apply updates** runs that check's install path and reports back. The agent
+  never reboots the machine; if one is owed, a **reboot required** badge
+  appears on the next inventory snapshot instead.
 - **Update agent** upgrades the Vantage agent on that machine. See
   [Agent updates](../operations/agent-updates.md).
 
@@ -107,8 +110,11 @@ Opens a browser SSH, RDP or VNC session. See [Browser console](./browser-console
 
 ## Windows servers
 
-Windows agents register, run workflow steps and report inventory. They do not
-manage `authorized_keys`.
+Windows agents register, heartbeat, run workflow steps, report inventory,
+check and apply OS updates, report workloads (services and containers), and
+serve the browser console. They do not manage `authorized_keys`, and they are
+not covered by package inventory or CVE scanning — the vulnerability feeds
+this project uses carry no Windows data.
 
 ## Removing a server