docs(runbooks): add runbook spec, template, index and 6 first-batch runbooks; light-enhance existing 10

- RUNBOOKS.md: repo-level spec (six-field model, naming, safety, maturity path)
- runbooks/_template.md + README.md: standard template and 16-entry routing index
- new: issue-to-merge, fix-ci, release, rollback, network-change, network-recovery
- light-enhance 10 existing runbooks with Purpose/Scope/Safety headers
- AGENTS.md: point step 3 at index/spec, add runbook execution rules
- docs/agent-runbook-guide.md: archive of Manus AI guide

runbooks/matrix-health.md

@@ -1,5 +1,14 @@
 # Matrix Health Check
 
+## Purpose
+
+Read-only health check of the Matrix homeserver (ESS on K3s).
+
+## Scope
+
+- Applicable: [synapse.chans.xyz](../hosts/synapse.chans.xyz.md), namespace `ess`.
+- Read-only: does not change pods, ingress, certificates, or configuration.
+
 Monitor the Matrix homeserver running on `synapse.chans.xyz` (ESS chart `26.7.2`, K3s node).
 
 Prefer `cd ansible && ansible-playbook playbooks/health-report.yml --limit matrix`
@@ -90,3 +99,9 @@ Backup automation is currently paused. `/var/backups/matrix/` is retained for a
 | Well-known returns 404/redirect | Root `chans.xyz` ingress missing or misconfigured |
 | 502 Bad Gateway | Synapse pod restarting or DB down |
 | SMTP emails not sent | MAS SMTP config incomplete; TCP reachable but AUTH failing — see `runbooks/vaultwarden-health.md` |
+
+## Safety
+
+- Read-only: never mutate pods, ingress, certificates, or configuration during this check.
+- Backup automation is paused; do not treat `/var/backups/matrix/` as a recovery source.
+- If live state conflicts with an expected value, `STOP` and report.