docs: align runbooks and validation structure

scripts/validate-repo.sh

@@ -134,12 +134,27 @@ fi
 # ---------------------------------------------------------------------------
 say "== 4. Runbook spec compliance (RUNBOOKS.md) =="
 PROCEDURE_RUNBOOKS="fix-ci.md issue-to-merge.md network-change.md network-recovery.md release.md rollback.md"
-GATED_REF_RUNBOOKS="mailcow-update.md ansible-operations.md home-assistant-maintenance.md vaultwarden-sqlite-to-postgres.md"
+GATED_REF_RUNBOOKS="mailcow-update.md ansible-operations.md home-assistant-maintenance.md matrix-e2ee-update.md vaultwarden-sqlite-to-postgres.md"
+RUNBOOK_INDEX="runbooks/README.md"
 for f in runbooks/*.md; do
   base="$(basename "$f")"
-  [ "$base" = "README.md" ] && continue
+  case "$base" in
+    README.md|_template.md) continue ;;
+  esac
   if ! grep -q "Last reviewed" "$f"; then fail "$f: missing 'Last reviewed'"; fi
   if ! grep -qE "STOP" "$f"; then fail "$f: missing explicit STOP condition"; fi
+  if ! grep -qE '^## Purpose$' "$f"; then fail "$f: missing '## Purpose'"; fi
+  if ! grep -qE '^## Scope$' "$f"; then fail "$f: missing '## Scope'"; fi
+  index_matches="$(grep -cF "]($base)" "$RUNBOOK_INDEX" || true)"
+  if [ "$index_matches" -ne 1 ]; then
+    fail "$f: expected exactly one entry in $RUNBOOK_INDEX (found $index_matches)"
+  fi
+  if grep -F "]($base)" "$RUNBOOK_INDEX" | grep -qF "| change"; then
+    case " $PROCEDURE_RUNBOOKS $GATED_REF_RUNBOOKS " in
+      *" $base "*) ;;
+      *) fail "$f: change runbook is not classified as procedure or gated-command" ;;
+    esac
+  fi
 done
 for base in $PROCEDURE_RUNBOOKS; do
   f="runbooks/$base"