docs: patching - maintenance windows, patch policies and runs

docs/vantage/vulnerabilities.md

@@ -55,12 +55,12 @@ against three-week-old data is not the same as a low count.
 
 ## Fixing something
 
-A finding with a known fixed version gets an **Apply updates** button, which
-runs the same OS update the server page offers. There is no separate patching
-mechanism.
+A finding with a known fixed version gets an **Apply updates** button. It
+installs every pending update on that server now and opens the
+[patch run](./patching.md#patch-runs) so you can see the result.
 
-Vantage never patches automatically. Applying updates is always something you
-ask for.
+To keep servers patched without clicking, create a
+[patch policy](./patching.md) with **Security updates only**.
 
 ## Accepting a finding