README: the runbooks are public — remove the 'Private' line and state the review intent

They were published to co-op/runbooks for member review, so the README's own 'Private: these contain...' line was both wrong and the first thing a reader saw. Also records the DNS sheet's wildcard caveat up front, and says explicitly that this repository is the source (no private copy).

README.md

@@ -1,6 +1,30 @@
 # Runbooks
 
-Operational runbooks for the co-op's infrastructure. Private: these contain
-topology, addresses, and procedure detail that should not be public.
+Operational runbooks for the co-op's infrastructure, published so **members can read them and
+raise problems**. That review is the point: these plans are safer when more eyes have been over
+them before anything irreversible happens.
 
-- [Cloudron server migration — Hostinger → Infomaniak](cloudron-server-migration.md)
+Comment, or open an issue. There is no separate private copy — this repository is the source.
+
+## Contents
+
+- **[cloudron-server-migration.md](cloudron-server-migration.md)** — the plan for moving Cloudron to
+  the new server: pre-flight, the cutover window, what must be in hand first, and how to verify a
+  restore. The one to read if you want to find problems.
+- **[dns-change-sheet.md](dns-change-sheet.md)** — the record-by-record cutover sheet.
+- **[migration-before-state.json](migration-before-state.json)** — the captured pre-migration state
+  that the restore checker compares against.
+- **[provider-pricing/](provider-pricing/)** — what our model providers charge, and when it changed.
+
+## Read the DNS sheet with this in mind
+
+Its record counts **cannot be trusted until reconciled against the registrar's panel.** The zone is
+wildcarded, so *any* hostname resolves — a name that answers proves nothing about whether a record
+exists. At least two listed records turned out not to exist, and the real record inventory is only
+visible in the registrar's own list.
+
+## No secrets here
+
+Audited 2026-11-01, including the full commit history: no credentials, tokens, keys, member emails
+or account identifiers. Where a runbook needs a credential to exist (a backup passphrase, an S3
+key), it records **where the credential is held**, never the credential.