docs(runbooks): add runbook spec, template, index and 6 first-batch runbooks; light-enhance existing 10

- RUNBOOKS.md: repo-level spec (six-field model, naming, safety, maturity path)
- runbooks/_template.md + README.md: standard template and 16-entry routing index
- new: issue-to-merge, fix-ci, release, rollback, network-change, network-recovery
- light-enhance 10 existing runbooks with Purpose/Scope/Safety headers
- AGENTS.md: point step 3 at index/spec, add runbook execution rules
- docs/agent-runbook-guide.md: archive of Manus AI guide

runbooks/vaultwarden-sqlite-to-postgres.md

@@ -1,5 +1,20 @@
 # Runbook: Vaultwarden SQLite → Postgres (us2)
 
+## Purpose
+
+Replay checklist for the exceptional SQLite→Postgres migration on us2.
+
+## Scope
+
+- Applicable: [us2.wsvc.info](../hosts/us2.wsvc.info.md), `/opt/vaultwarden`.
+- Not applicable: routine reconcile — this is destructive and intentionally not automated.
+
+## Safety
+
+- Destructive: requires explicit approval; confirm backups exist before starting.
+- Do not commit `.env` or password-bearing files to git.
+- If any step diverges from this checklist, `STOP` and report.
+
 Target: [us2.wsvc.info](../hosts/us2.wsvc.info.md)  
 Upstream: [Using the PostgreSQL Backend](https://github.com/dani-garcia/vaultwarden/wiki/Using-the-PostgreSQL-Backend) · [docs/vaultwarden-upstream.md](../docs/vaultwarden-upstream.md)