Start DISCTL-WP-0002: policies, registers, runbooks, playbooks

Expand AssetRegister and DataRegister with T0/T4 stack assets.
Add ResiliencePolicy, PanicSheet, full-server-loss runbook, and five
incident playbooks. Update README with mirror status. Mark T02-T05,
T07-T08 done; T01 and T06 in progress.

IncidentPlaybooks/loss-of-admin-identity.md

@@ -0,0 +1,25 @@
+# Playbook: Loss of Admin Identity
+
+**Triggers:** locked out of registrar, Gitea, Stripe, Bubble, email, cloud; lost MFA device.
+
+## Steps
+
+1. **Identify which identity** — registrar, payment, forge, email, secrets vault.
+2. **Break-glass account** — use documented secondary admin if available (see `AssetRegister.yaml` recovery_path).
+3. **Offline recovery codes** — MFA reset via vendor recovery flow; requires pre-stored codes.
+4. **Vendor support** — IONOS/Stripe identity verification; allow 24–48h; have domain ownership proof ready.
+5. **Verify ownership** — confirm domain/registrar records unchanged; check for hostile transfer.
+6. **Rotate compromised identity** — new password, new MFA, revoke active sessions.
+7. **Restore dependent access** — Gitea/Forgejo admin, DNS, backup admin, OpenBao.
+8. **Update registers** — record recovery paths discovered; close gaps in `AssetRegister.yaml` T0 section.
+9. **Document** — evidence log; **no recovery codes in Git**.
+
+## Prevention (ongoing)
+
+- Record backup admin contacts per T0 asset.
+- Store MFA recovery codes in password manager.
+- Registrar lock enabled.
+
+## References
+
+`AssetRegister.yaml` T0 · `PanicSheet.md` §2 · `ResiliencePolicy.md`