docs(security): 新增 SSH Network owner request draft [skip ci]

docs/security/SSH-NETWORK-ACCESS-INVENTORY.md

@@ -15,6 +15,10 @@
 
 本階段仍是 repo-only 只讀清冊。它不是 live host truth，不是 firewall approval，不是 known_hosts patch approval，不是 NetworkPolicy apply approval，也不是 WireGuard cutover approval。
 
+2026-06-14 已新增 `docs/security/SSH-NETWORK-OWNER-REQUEST-DRAFT.md` 與 `docs/security/ssh-network-owner-request-draft.snapshot.json`，將 16 個 SSH / network access surface 轉成 owner request draft。固定 `request_draft_count=16`、`write_capable_request_draft_count=6`、`live_evidence_required_request_count=16`、`required_owner_field_count=13`、`blocked_action_count=16`、`request_sent_count=0`、`owner_response_received_count=0`、`runtime_gate_count=0`。
+
+此 artifact 只表示 owner request 的 required shape，不代表 request sent、recipient confirmed、owner response received / accepted、live host read、host keyscan、known_hosts patch、firewall / port change、NetworkPolicy apply、NodePort change、WireGuard change、sudo、deploy SSH、secret collection、host write、production write 或 runtime gate。
+
 ## 2. 覆蓋摘要
 
 | 指標 | 目前值 | 說明 |
@@ -109,3 +113,4 @@ python3 scripts/security/ssh-network-access-inventory.py \
 | owner response 收件 | `0%` | 尚未收到或接受 owner response |
 | live evidence collection | `0%` | 未 SSH、未 keyscan、未讀 live firewall、未讀 live sudoers |
 | SSH / sudo / firewall / NetworkPolicy / NodePort / WireGuard gate | `0%` | 全部維持未授權 |
+| owner request draft | `100%` | 已新增 16 份 request draft、snapshot、文件與 guard；request sent / received / accepted 仍為 0 |