docs(runbooks): add runbook spec, template, index and 6 first-batch runbooks; light-enhance existing 10

- RUNBOOKS.md: repo-level spec (six-field model, naming, safety, maturity path)
- runbooks/_template.md + README.md: standard template and 16-entry routing index
- new: issue-to-merge, fix-ci, release, rollback, network-change, network-recovery
- light-enhance 10 existing runbooks with Purpose/Scope/Safety headers
- AGENTS.md: point step 3 at index/spec, add runbook execution rules
- docs/agent-runbook-guide.md: archive of Manus AI guide

runbooks/vaultwarden-health.md

@@ -1,5 +1,14 @@
 # Runbook: Vaultwarden health (us2)
 
+## Purpose
+
+Read-only health check of the Vaultwarden stack (Postgres backend) on us2.
+
+## Scope
+
+- Applicable: [us2.wsvc.info](../hosts/us2.wsvc.info.md), `/opt/vaultwarden`.
+- Read-only: does not change Vaultwarden, Traefik, SMTP, or secrets.
+
 Target: [us2.wsvc.info](../hosts/us2.wsvc.info.md)  
 Path: `/opt/vaultwarden`  
 URL: https://auth.wsvc.info/  
@@ -96,6 +105,12 @@ Expect `AUTH_OK`. `535` usually means stale password in `config.json` (see step
 The sanitized Ansible health profile is `vaultwarden` (`ansible/playbooks/healthchecks.yml`). It runs locally through `vps-healthcheck.timer`, writes a sanitized JSON result to `/var/lib/vps-health/latest.json`, and uses only server-side credentials for the SMTP AUTH probe. It does not modify Vaultwarden, Traefik, SMTP, or secrets.
 
 
+## Safety
+
+- Read-only: never mutate configuration, containers, or secrets during this check.
+- Never print passwords — compare lengths/hashes only.
+- If live state conflicts with an expected value below, `STOP` and report.
+
 ## Pass criteria
 
 - Healthy compose; `DATABASE_URL` points at `pg`