Reorganize: scripts under scripts/, add README disclaimer

- Move _template.ps1 and cg-disable.ps1 into scripts/
- Update all fetch/run URLs and doc links to scripts/ paths
- Rework README layout/naming section; add as-is/no-warranty disclaimer

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -9,6 +9,9 @@ client workstations during on-site work with short, hand-typeable commands.
 > screenshots. Procedures with placeholders **only**. See
 > [CONTRIBUTING.md](CONTRIBUTING.md) for the sanitization rule.
 
+> Provided as-is, no warranty. Running any script is at your own risk. Contains
+> no client-identifying data by policy.
+
 ## Using a runbook
 
 Fetch and read on the target workstation:
@@ -17,19 +20,25 @@ Fetch and read on the target workstation:
 irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/<file> | more
 ```
 
-Run an executable runbook script directly:
+Run an executable runbook script directly (scripts live under `scripts/`):
 
 ```powershell
-irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/<file>.ps1 | iex
+irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/<file>.ps1 | iex
 ```
 
 Scripts prompt for anything client-specific via `Read-Host` — nothing to edit
-before running. See [`_template.ps1`](_template.ps1) for the convention.
+before running. See [`scripts/_template.ps1`](scripts/_template.ps1) for the
+convention.
 
-## Naming
+## Layout & naming
 
-Flat repo, short filenames, light category prefixes so URLs stay
-hand-typeable:
+- **Runbooks** (`.md`) live flat at the repo root with short, hand-typeable
+  filenames and light category prefixes.
+- **Scripts** (`.ps1`) live under [`scripts/`](scripts/). `_template.ps1`
+  sorts first and is the convention reference, not a runnable runbook.
+- **Meta** (`README.md`, `CONTRIBUTING.md`) stays at the root.
+
+Runbook prefixes:
 
 | Prefix | Domain |
 |---|---|
@@ -37,7 +46,6 @@ hand-typeable:
 | `m365-` | Microsoft 365 / Entra |
 | `od-` | Open Dental |
 | `net-` | Networking |
-| `_` | Meta / templates (not a runbook) |
 
 ## Placeholder conventions
 
@@ -58,7 +66,7 @@ run time — never commit filled-in values.
 | File | Purpose |
 |---|---|
 | [`od-smb-cred.md`](od-smb-cred.md) | Open Dental SMB share — stored-credential fix |
-| [`cg-disable.ps1`](cg-disable.ps1) | Disable Credential Guard, then reboot (prompts to confirm) |
+| [`scripts/cg-disable.ps1`](scripts/cg-disable.ps1) | Disable Credential Guard, then reboot (prompts to confirm) |
 
 ## Tiers