docs: update architecture diagram and README to reflect SNow CVE demo flow

CHANGELOG.md

@@ -5,6 +5,15 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Changed (2026-06-16)
+
+- **Architecture diagram updated** — replaced `docs/images/instantaneous-patching-architecture.png`
+  with a new diagram reflecting the actual SNow CVE demo flow: 6 steps, EDA as a
+  distinct component, no Jira, and the 4 AAP workflow nodes (Link CMDB CI →
+  Fetch Remediation Plan → Patch RHEL → Close Incident).
+- **README steps updated** — title changed to "Accelerated Patching", architecture
+  steps rewritten to match the live demo workflow. Closes #139.
+
 ### Added (2026-06-16)
 
 - **OpenShift credential placeholders in `dev-environment.sh.example`** — added

README.md

@@ -1,6 +1,6 @@
 # aap.lightspeed.patching
 
-> **Instantaneous Patching — Patching in the Mythos era**
+> **Accelerated Patching — in the Mythos era**
 
 Automated, AI-assisted patching workflow combining **Red Hat Lightspeed**,
 **Ansible Automation Platform (AAP)**, and **Event-Driven Ansible (EDA)** to
@@ -13,10 +13,16 @@ identify, remediate, and record CVEs and advisories — with full ITSM integrati
 ![Instantaneous Patching Architecture](docs/images/instantaneous-patching-architecture.png)
 
 ```
-1. RHEL systems register to Red Hat Lightspeed
-2. CVE / Advisor identified by Lightspeed
-3. AAP runs patch job template against affected hosts
-4. ITSM Change Request created and updated (ServiceNow)
+1. RHEL hosts registered to Red Hat Insights
+2. Red Hat Insights scans for CVEs and advisories
+3. CVE identified — triggers automated response
+4. ServiceNow incident created automatically
+5. Event-Driven Ansible picks up the event and fires the remediation workflow
+6. AAP Remediation Workflow:
+   a. Link CMDB CI to the incident
+   b. Fetch the Insights remediation plan
+   c. Patch the RHEL host
+   d. Close the incident ("Solved Permanently")
 ```
 
 ---