refactor(scripts): move ops and docs scripts by audience, gate terramate script paths

.pre-commit-config.yaml

@@ -73,7 +73,7 @@ repos:
     hooks:
       - id: check-rebased
         name: Branch is rebased on origin/main
-        entry: scripts/check-rebased.sh
+        entry: scripts/ci/check-rebased.sh
         language: script
         stages: [pre-push]
         always_run: true

apps/platform/image-gallery/loadgen.yaml

@@ -2,7 +2,7 @@
 #
 # SUSPENDED by default. When resumed it runs `steady` (1 req/s, the mixed API
 # mix) for 14 minutes every 15 minutes, so dashboards always have data.
-# On-demand runs of any scenario: scripts/demo-load.sh <scenario>.
+# On-demand runs of any scenario: scripts/ops/demo/load.sh <scenario>.
 #
 # The image tag moves with the App's (apps/base/complete/app.yaml): same release, same API.
 apiVersion: batch/v1

docs/architecture/AGENTS.md

@@ -23,14 +23,14 @@ Stop at the first hit:
 
 | # | Source | How |
 |---|---|---|
-| 1 | `icons/` | `./scripts/diagram-icons.py style <name>` — 15 logos already rasterised |
+| 1 | `icons/` | `./scripts/docs/diagram-icons.py style <name>` — 15 logos already rasterised |
 | 2 | mxgraph stencil | `shapesearch.py "<terms>"`, then rasterise into `icons/` |
 | 3 | CNCF Artwork | **list** `projects/<slug>/icon/color/` and pick the SVG — filenames are not derivable |
 | 4 | Project brand | `aiicons.py "<brand>" --embed`, then rasterise |
 | 5 | — | a clean ogenki box, no icon |
 
 Reaching step 5 is fine. Skipping to it without trying 1–4 is the failure this rule exists to stop.
-`./scripts/diagram-icons.py audit` lists boxes that name a product and render without one,
+`./scripts/docs/diagram-icons.py audit` lists boxes that name a product and render without one,
 grouped by which source would supply it. **Advisory, deliberately not a CI gate** — whether a box
 wants a logo is a judgment call, and a gate that can go red on a judgment call gets switched off.
 
@@ -100,7 +100,7 @@ A logo used by a second diagram belongs in `icons/`, not embedded twice. Check `
 ## After any diagram change
 
 ```bash
-./scripts/export-diagrams.sh      # regenerates every SVG the site embeds
+./scripts/docs/export-diagrams.sh    # regenerates every SVG the site embeds
 ./scripts/ci/validate-links.sh       # after any file move
 ./scripts/ci/validate-doc-claims.sh  # the pages that describe the diagram
 ```

docs/architecture/README.md

@@ -6,7 +6,7 @@ Drawio (`.drawio`) sources. Open with the [drawio desktop app](https://www.drawi
 **One command regenerates every export:**
 
 ```bash
-./scripts/export-diagrams.sh
+./scripts/docs/export-diagrams.sh
 ```
 
 It writes SVG to `website/static/images/diagrams/`, writes the one PNG GitHub still needs, and
@@ -76,13 +76,13 @@ re-rasterising its own.
 
 | # | Source | How |
 |---|--------|-----|
-| 1 | `icons/` | `./scripts/diagram-icons.py style <name>` — paste-ready, ogenki palette applied |
+| 1 | `icons/` | `./scripts/docs/diagram-icons.py style <name>` — paste-ready, ogenki palette applied |
 | 2 | mxgraph stencil | `shapesearch.py "<terms>"` to find it, then **rasterise it into `icons/`** — see below |
 | 3 | [CNCF Artwork](https://github.com/cncf/artwork) | **list** `projects/<slug>/icon/color/` and pick the SVG — `external-secrets-operator` ships `eso-icon-color.svg`, so filenames are not slugs |
 | 4 | Project brand | `aiicons.py "<brand>" --embed` |
 | 5 | none | a clean ogenki box — the honest fallback, only after 1–4 miss |
 
-`./scripts/diagram-icons.py audit` lists every box that names a product and renders without one,
+`./scripts/docs/diagram-icons.py audit` lists every box that names a product and renders without one,
 grouped by which source would supply it. It is advisory, not a CI gate: whether a box wants a logo
 is a judgment call, and a gate that can go red on a judgment call gets switched off.
 

docs/architecture/icons/manifest.json

@@ -1,5 +1,5 @@
 {
-  "_note": "Logos rasterised for platform-overview.drawio and extracted here so every diagram references one asset instead of re-fetching and re-rasterising its own. PNG, not SVG: headless drawio export does not render SVG data URIs. Embed with image=data:image/png,<base64> -- a comma, not ';base64,', which terminates the style value. Prefer ./scripts/diagram-icons.py style <name> over hand-rolling one.",
+  "_note": "Logos rasterised for platform-overview.drawio and extracted here so every diagram references one asset instead of re-fetching and re-rasterising its own. PNG, not SVG: headless drawio export does not render SVG data URIs. Embed with image=data:image/png,<base64> -- a comma, not ';base64,', which terminates the style value. Prefer ./scripts/docs/diagram-icons.py style <name> over hand-rolling one.",
   "_aliases_note": "victorialogs and victoriatraces currently render the VictoriaMetrics mark -- platform-overview used one logo for all three, and the three extracted files were byte-identical. Both projects have their own upstream logo; fetch the real marks, add them as files, and drop the alias.",
   "aliases": {
     "envoy": "envoy-ai-gateway",