[Feature] Controlled "Route-to-Live" Promotion Model for AKS Node OS Security Patch Auto-Upgrades

**Is your feature request related to a problem? Please describe.**
Background

We have enabled AKS node OS auto-upgrades using the "SecurityPatch" channel on a weekly cadence for our build/non-production environments.

However, we are looking for a controlled mechanism to ensure that the exact same validated security patches applied in build environments are consistently promoted to live/production environments in a predictable and phased manner.

Business Justification

This request is driven by a previous production-impacting incident we experienced after enabling node OS auto-upgrades with the "SecurityPatch" channel.

In that instance, a security patch rollout introduced unexpected issues which resulted in an outage affecting the entire environment. Since the patches were automatically applied without a clearly controlled promotion path between environments, we had limited ability to validate and safely progress the rollout from build to production.

As a result, we are seeking stronger controls and visibility around how AKS node OS security patches move across environments.

Current Concern

Currently, node OS security patches appear to be rolled out automatically based on platform/regional availability, but there does not appear to be a defined “route-to-live” or promotion model that guarantees alignment between lower and production environments.

This creates challenges such as:

- Inability to reliably validate patches in build before production rollout
- Risk of production outages due to unvalidated patches
- Reduced confidence in automated patching strategies

**Describe the solution you'd like**
We would like AKS to provide a controlled promotion/alignment mechanism for node OS security patch upgrades across environments.
Ensure consistency between build and live environments
Implement safer phased rollout strategies

**Describe alternatives you've considered**
We would also appreciate clearer public documentation regarding:

- Frequency/cadence of AKS node OS security patch releases
- Whether patches follow a fixed weekly/monthly release cycle
- Whether there is a typical release day for node OS security patches

**Additional context**
Having a controlled “route-to-live” model for AKS node OS security patches would significantly improve rollout safety, operational confidence, and production stability while still allowing customers to benefit from automated security patching.