Reorganize: scripts under scripts/, add README disclaimer

- Move _template.ps1 and cg-disable.ps1 into scripts/
- Update all fetch/run URLs and doc links to scripts/ paths
- Rework README layout/naming section; add as-is/no-warranty disclaimer

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CONTRIBUTING.md

@@ -44,7 +44,7 @@ split the particular out to the private tier and reference it as a placeholder.
 
 ## Scripts
 
-Follow [`_template.ps1`](_template.ps1):
+Scripts live under `scripts/`. Follow [`scripts/_template.ps1`](scripts/_template.ps1):
 
 - Prompt for placeholders with `Read-Host` — no editing before running, no
   `param()` (can't pass args through `irm | iex`).

README.md

@@ -9,6 +9,9 @@ client workstations during on-site work with short, hand-typeable commands.
 > screenshots. Procedures with placeholders **only**. See
 > [CONTRIBUTING.md](CONTRIBUTING.md) for the sanitization rule.
 
+> Provided as-is, no warranty. Running any script is at your own risk. Contains
+> no client-identifying data by policy.
+
 ## Using a runbook
 
 Fetch and read on the target workstation:
@@ -17,19 +20,25 @@ Fetch and read on the target workstation:
 irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/<file> | more
 ```
 
-Run an executable runbook script directly:
+Run an executable runbook script directly (scripts live under `scripts/`):
 
 ```powershell
-irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/<file>.ps1 | iex
+irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/<file>.ps1 | iex
 ```
 
 Scripts prompt for anything client-specific via `Read-Host` — nothing to edit
-before running. See [`_template.ps1`](_template.ps1) for the convention.
+before running. See [`scripts/_template.ps1`](scripts/_template.ps1) for the
+convention.
 
-## Naming
+## Layout & naming
 
-Flat repo, short filenames, light category prefixes so URLs stay
-hand-typeable:
+- **Runbooks** (`.md`) live flat at the repo root with short, hand-typeable
+  filenames and light category prefixes.
+- **Scripts** (`.ps1`) live under [`scripts/`](scripts/). `_template.ps1`
+  sorts first and is the convention reference, not a runnable runbook.
+- **Meta** (`README.md`, `CONTRIBUTING.md`) stays at the root.
+
+Runbook prefixes:
 
 | Prefix | Domain |
 |---|---|
@@ -37,7 +46,6 @@ hand-typeable:
 | `m365-` | Microsoft 365 / Entra |
 | `od-` | Open Dental |
 | `net-` | Networking |
-| `_` | Meta / templates (not a runbook) |
 
 ## Placeholder conventions
 
@@ -58,7 +66,7 @@ run time — never commit filled-in values.
 | File | Purpose |
 |---|---|
 | [`od-smb-cred.md`](od-smb-cred.md) | Open Dental SMB share — stored-credential fix |
-| [`cg-disable.ps1`](cg-disable.ps1) | Disable Credential Guard, then reboot (prompts to confirm) |
+| [`scripts/cg-disable.ps1`](scripts/cg-disable.ps1) | Disable Credential Guard, then reboot (prompts to confirm) |
 
 ## Tiers
 

od-smb-cred.md

@@ -41,7 +41,7 @@ System Summary → **Virtualization-based security Services Running**
 Fastest, from an **elevated** PowerShell:
 
 ```
-irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/cg-disable.ps1 | iex
+irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/cg-disable.ps1 | iex
 ```
 
 It confirms, clears the flags, and prompts to reboot.

scripts/_template.ps1

@@ -7,7 +7,7 @@
 
 .NOTES
   Convention for scripts in this repo — designed to run via:
-      irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/<file>.ps1 | iex
+      irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/<file>.ps1 | iex
 
   Because `irm | iex` runs in the caller's session:
     - No param() block — you can't pass args through the pipe. Prompt with

scripts/cg-disable.ps1

@@ -11,7 +11,7 @@
   Business), not plain Pro.
 
 .NOTES
-  Run via:  irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/cg-disable.ps1 | iex
+  Run via:  irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/cg-disable.ps1 | iex
   Referenced by od-smb-cred.md, Step 3.
 
   If Credential Guard is still running after reboot, it was enabled with a