Move runbooks into domain directories

od-db-backup.md becomes od/db-backup.md -- the hyphen becomes a slash, so
the fetch command is exactly as long to type as before. That mattered: the
length of a hand-typed command is the constraint this repo is organized
around, and a reorganization that lengthened it would have been a net loss.

Scripts deliberately stay flat in scripts/ with their domain prefix.
Everything executable in one directory is the set worth reading before it
runs, and nesting five files by domain would add characters without adding
clarity.

Updates every reference: README Contents (now grouped by directory), the
layout section, both fetch examples, inter-runbook links, and the .NOTES
headers in all five scripts. Verified every markdown link resolves on disk
and that Contents and the filesystem agree in both directions.

Records the naming rule in CONTRIBUTING so the next file lands correctly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7

CONTRIBUTING.md

@@ -34,6 +34,21 @@ Instead use placeholders: `<CLIENT>`, `<SERVER>`, `<SHARE>`, `<SHARE_USER>`,
 If a step can't be written without a real particular, it doesn't belong here —
 split the particular out to the private tier and reference it as a placeholder.
 
+### Naming
+
+Runbooks go in a domain directory and drop the prefix — `od/db-backup.md`, not
+`od-db-backup.md`. The directory *is* the prefix, which keeps the fetch command
+exactly as short as it was. Existing domains are `od/` and `sec/`; add `win/`,
+`m365/`, or `net/` when the first file needs one.
+
+Scripts stay flat in `scripts/` and keep their domain prefix. Everything
+executable lives in one directory on purpose — that is the set worth reading
+before it runs. Non-interactive scripts (Intune remediations) get their own
+sibling directory, not `scripts/`.
+
+Filenames stay short: they are typed by hand on a client keyboard, often
+mid-incident. That constraint outranks descriptiveness.
+
 ## Before every commit
 
 1. Re-read the diff. Would a stranger learn *who* the client is, or *how to