docs: reshape runbooks into .agents/skills/<name>/SKILL.md (phase 4)

Problem: runbooks are agent-executable procedures but lived at the repo root,
separate from the other agent instruction now under .agents/.

Change:
- Move runbooks/<name>.md -> .agents/skills/<name>/SKILL.md (folder per skill,
  matching the wiki-hq skills layout). Frontmatter (name, risk_class, inputs,
  verification, docs_update_checklist, transition) preserved.
- Rewrite links (inbound from plans; between-skill siblings) via the move map.
- Update prose references in AGENTS.md, HERMES.md, .agents/OIKOS.md, and the
  operations schema; fix a pre-existing stale link to operations/commands.md.

No code consumed runbooks/ by path, so nothing else changes.

Verification: all SKILL.md frontmatter parses with valid risk_class; every
lifecycle transition resolves to an oikos/ontology.yaml state; broken-link
count 127 -> 126 (fixed one, introduced none).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.agents/skills/service-health-check/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: service-health-check
+risk_class: read_only
+inputs: [service_name]
+verification: "homelab service <name> health"
+docs_update_checklist: []
+---
+
+# Service health check
+
+Goal: determine whether a service is actually healthy, without ad-hoc SSH.
+
+1. `homelab service <name> explain` — read the context card: backend,
+   blast radius, doc pointer, risk notes.
+2. `homelab service <name> health` — live health probe (HTTP code against
+   the service's `url`/`endpoint`). Once the Week-3 scheduler ships, this
+   reads a cached snapshot by default; pass `--live` to force a fresh probe.
+3. If unhealthy, `homelab service <name> log` (or MCP `tail_log`) for the
+   last 200 lines.
+4. Cross-check blast radius: `homelab node <name> relations` — is this
+   entity's own backend host healthy? A downstream failure (e.g. `strong`
+   down) will show up here before the service's own logs explain anything.
+5. If the fix is a restart: classify first (`oikos/policy.yaml` —
+   `service-restart` is `reversible_low` unless the service has a
+   `service_overrides` entry, e.g. `caddy`/`dns` are `config_mutation`).
+   Unattended agents may act on `reversible_low` without approval.
+
+Docs-update checklist: none for a pure health check. If the investigation
+reveals stale `risk_notes` or a wrong `doc_page`, fix `inventory.yaml` in
+the same session.