Sovereignty migration runbooks

Every read of this page is logged to sovereignty_vault_log. Runbook bodies never reach a client bundle for non-Archon callers.