add Phase 2A container and recovery readiness gates

docs/le-app-database-migration/phase2a-host-maintenance/maintenance-worksheet.md

@@ -0,0 +1,32 @@
+# Phase 2A maintenance worksheet
+
+```text
+PUBLIC_HEALTH_URLS='https://db.lasereverything.net/'
+EXTRA_CRITICAL_UNITS=''
+LE_PHASE2A_RECOVERY_READY=<UNSET>
+LE_PHASE2A_BACKUPS_READY=<UNSET>
+
+maintenance_window=<UNSET>
+user_notification=<UNSET>
+rollback_decision_owner=<UNSET>
+independent_console_access=<UNSET>
+independent_root_access=<UNSET>
+previous_kernel_boot_procedure=<UNSET>
+```
+
+Verified evidence:
+
+- protected Directus archive manifest: `PASS`, return code 0;
+- Docker: 88 total, 87 running, retired `directus` intentionally stopped;
+- sole unhealthy running container: reviewed unrelated `sonarr`;
+- `makearmy-app` running; `bgbye` running and healthy;
+- `le-directus-source` and `le-payload-pg` running;
+- running restart-policy `no`: `castopod`, `castopod-redis`;
+- DrKonqi disposition: exact checksummed 234-unit allowlist preserved;
+- NoMachine removed; `nxserver.service` absent and not critical;
+- GRUB: normal, fallback, and recovery entries for `linux-zen` and `linux`;
+- Snapper snapshots 1–3 exist; `grub-btrfs.cfg` snapshot entries absent;
+- `grub-btrfs-snapper.path` active and watching.
+
+The recovery and backup attestations must remain unset until the operator has
+personally confirmed recovery access and completed the proportional backup plan.