Create Risk Register Management runbook

[dandye]

Fixes #29 by adding documentation on what a risk register is, its core attributes, why SecOps relies on it, and its lifecycle. The document conforms to the structure guidelines and includes a rubric and mermaid diagram.

---

PR created automatically by Jules for task 10464344979065759157 started by @dandye

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Code Review

This pull request introduces a new 'Risk Register Management' runbook and updates the sitemap to include it. The runbook provides a structured approach for SecOps teams to track and manage security risks, including a workflow diagram and evaluation rubric. Review feedback suggests enhancing the sitemap with a reference to SOAR documentation, explicitly linking input variables within the workflow steps to improve LLM agent execution, and resolving an inconsistency between the completion criteria and the rubric regarding Mermaid diagram requirements.

[gemini-code-assist]

This rubric item asks if the agent generated a Mermaid sequence diagram. However, the 'Completion Criteria' (line 93) only requires an execution timestamp and runtime metrics. Furthermore, a static Mermaid diagram is already provided in the runbook (lines 69-86). Unless the agent is specifically expected to generate a new or customized diagram for each execution, this rubric item may be confusing. Consider aligning the rubric with the actual completion criteria.

[dandye]

Review — closes #29 and content is solid, but three fixes needed before merge:

1. Frontmatter is stale vs OKF v0.2 (merged in Migrate frontmatter to OKF v0.2 conventions #32 after this branch was cut): status: active should be stable, and the generated {by, at} block is missing (present in 32/32 other runbooks).
2. LLMS-SITEMAP.md entry asserts a reference to common_steps/document_in_soar.md that the runbook never makes — drop the references suffix or actually cite the common step.
3. Rubric grades a Mermaid diagram the Completion Criteria never ask for, and invents a runtime-metrics requirement found in zero other runbooks; align the two sections. Also add a trailing newline.

Non-blocking: nothing routes to this runbook yet — consider cross-linking from soc_analyst_workflows.md or soc_manager.md.