[JonathanLEvans]

Summary

Add a human-friendly guide to publishing, rejecting, and unrejecting CVE records, including:

• A table matching common curator actions to API endpoints.
• The distinction between CVE ID objects and submitted CVE records.
• Ownership and role requirements, complete-container replacement semantics, and request examples.
• Rejection and unrejection effects on dates, CNA content, and ADP containers.
• The limited ID-only return-to-RESERVED case and post-update consistency checks.

Behavior was checked against the controllers, route authorization, model helpers, request validation, and OpenAPI specification at eff17ea. The guide links to the relevant implementation and notes that source behavior does not establish the version deployed in production.

Validation

• Parsed both JSON request examples.
• Checked the Bash example with bash -n.
• Checked Markdown reference definitions and whitespace.
• Verified the committed document matches the reviewed local file and the branch changes only this document.
• No live CVE changes or service integration tests were performed (documentation-only change).

[todb]

LGTM!