unattended-upgrades was already active on the host, just never documented or closed. Adds a generic, reusable systemd timer + script that fires before the daily update window and notifies via email and a Matrix thread reply if any packages are actually pending - reusing the mas-cli bot account pattern established for Draupnir. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>